Information Systems Security Manager (ISSM)

Random Bit LLC; Atlanta (GA); On-site; USD 120,000 - 180,000; Full time

Job summary

Random Bit LLC is seeking an Information Systems Security Manager to support a state Medicaid agency’s Enterprise Security & Compliance team. You will guide governance, risk, and compliance efforts across regulatory assessments, control validation, and remediation activities.

You will collaborate with security analysts, technology teams, and leadership to translate requirements into actionable evidence and robust documentation, ensuring assessment readiness and continuous improvement across

Qualifications

• Professional experience in cybersecurity, information security, governance, risk, compliance, IT audit, security architecture, or a closely related discipline.
• Experience translating requirements into actionable control, documentation, or evidence.
• Experience reviewing, developing, or maintaining information security policies, standards, procedures, and governance documentation.
• Experience performing security control assessments, compliance assessments, gap analyses, or audit-readiness activities.
• Working knowledge of cybersecurity control frameworks and security risk management concepts.
• Ability to communicate security and compliance requirements effectively to technical and non-technical stakeholders.
• Strong written communication and organizational skills with multiple controls and evidence requests.
• Ability to work independently on compliance assignments while collaborating with security analysts, technical teams, leadership, auditors, and assessors.

Responsibilities

• Compliance Assessments and Audit Readiness: Support assessments and audit-readiness for CMS ARC-AMPE, HITRUST r2, SSA regulatory audits, and other requirements, including evidence preparation and responses to findings.
• Control Analysis and Gap Identification: Interpret requirements, evaluate documentation and implementation, identify gaps in policies, procedures, standards, and evidence.
• Policy and Standards Development: Review, update, and develop security policies, standards, guidelines, and related documentation.
• Procedure Development: Collaborate with analysts and operations to document and improve security procedures reflecting practices and control implementation.
• Objective Evidence Management: Identify required evidence, evaluate relevance, completeness, and currency, and coordinate with control owners to obtain artifacts.
• Control Mapping and Traceability: Maintain mappings between requirements, controls, policies, procedures, stakeholders, and evidence.
• Remediation Support: Document deficiencies, recommend actions, and coordinate remediation activities to resolution.
• Stakeholder Collaboration and Process Improvement: Work with security, infrastructure, cloud, apps, data, and business teams to validate controls and improve documentation.

Skills

GRC governance

Audit readiness

Policy & standards development

Control mapping & traceability

Stakeholder collaboration

Written communication

Analytical / organizational skills

Independent work on compliance

Job description

The Information Systems Security Manager supports a state Medicaid agency’s Enterprise Security & Compliance team by providing cybersecurity governance, risk, and compliance (GRC) support across regulatory assessments, security control validation, audit readiness, documentation management, and remediation activities.

This role works closely with agency security analysts, technology teams, business stakeholders, leadership, and assessment teams to evaluate the agency’s compliance posture against frameworks and assessment requirements, including CMS ARC-AMPE, HITRUST r2, and SSA regulatory compliance audits.

The Information Systems Security Manager translates security and compliance requirements into actionable documentation, control expectations, procedures, and objective evidence requirements while identifying and helping remediate gaps that could affect assessment readiness.

Key Responsibilities

• Compliance Assessments and Audit Readiness: Support compliance assessments and audit-readiness activities for CMS ARC-AMPE, HITRUST r2, SSA regulatory compliance audits, and other applicable requirements, including evidence preparation, assessor coordination, and responses to findings
• Control Analysis and Gap Identification: Interpret security and compliance requirements, evaluate existing control documentation and implementation, and identify gaps in policies, procedures, standards, and supporting evidence
• Policy and Standards Development: Review, update, and develop security policies, standards, guidelines, and related documentation to address applicable security and compliance requirements
• Procedure Development: Collaborate with agency security analysts and operational teams to develop, document, and improve security procedures that accurately reflect operational practices and control implementation
• Objective Evidence Management: Identify required objective evidence, evaluate its relevance, completeness, accuracy, and currency, and coordinate with control owners to obtain and maintain appropriate supporting artifacts
• Control Mapping and Traceability: Maintain mappings between regulatory requirements, security controls, policies, procedures, responsible stakeholders, and objective evidence to demonstrate compliance and support assessments
• Remediation Support: Document identified control and documentation deficiencies, recommend corrective actions, and collaborate with responsible stakeholders to develop and track remediation activities through resolution
• Stakeholder Collaboration and Process Improvement: Work with security, infrastructure, cloud, application, data, and business teams to validate control implementation and improve compliance documentation, evidence collection, and assessment processes

Required Qualifications

• Professional experience in cybersecurity, information security, governance, risk, compliance, IT audit, security architecture, or a closely related discipline
• Demonstrated experience interpreting security or compliance requirements and translating them into actionable control, documentation, procedural, or evidence requirements
• Experience reviewing, developing, or maintaining information security policies, standards, procedures, and related governance documentation
• Experience performing security control assessments, compliance assessments, gap analyses, or audit-readiness activities
• Working knowledge of cybersecurity control frameworks and security risk management concepts
• Ability to communicate security and compliance requirements effectively to both technical and non-technical stakeholders
• Strong written communication skills with the ability to create clear, defensible, and assessment-ready documentation
• Strong analytical and organizational skills, including the ability to manage multiple controls, findings, evidence requests, and remediation activities concurrently
• Ability to work independently on defined compliance assignments while collaborating effectively with security analysts, technical teams, leadership, auditors, and assessors

Preferred Qualifications

• Experience supporting state Medicaid, healthcare, government, or another highly regulated environment
• Direct experience with one or more of the following:
• CMS ARC-AMPE
• HITRUST CSF or HITRUST r2 assessments
• SSA regulatory compliance audits
• NIST SP 800-53
• NIST Cybersecurity Framework
• CMS or Medicaid security and compliance requirements
• Familiarity with HITRUST ai2 assessments and associated security and compliance requirements
• Experience developing control crosswalks or mapping requirements across multiple security and compliance frameworks
• Experience supporting formal audits, third-party assessments, certification activities, or regulatory reviews
• Familiarity with cloud and enterprise technology environments sufficient to understand how technical controls are implemented and evidenced
• Experience working with security analysts, system owners, application teams, infrastructure teams, cloud teams, and other control owners to document security processes
• Familiarity with governance, risk, and compliance tools or structured compliance evidence repositories