NIH Zero-Trust Policy Lead

eTelligent Group LLC

Bethesda (MD)

Hybrid

USD 110,000 - 120,000

Full time

2 days ago

Be an early applicant

Application generator

Stand out for this role — generate a tailored resume and cover letter in about a minute.

Get past ATS filters

Job summary

eTelligent Group LLC is seeking a senior cybersecurity policy lead to translate NIH ZTA and federal mandates into a unified NIH policy framework. You will drive policy statements, standards, and procedures, linking them to authoritative sources and enforcement checkpoints.

The role requires 8+ years in federal policy, strong technical writing, and NIH suitability. You will craft policy anchors, lead risk-based policy governance, and support policy communications across the NIH OCIO.

Qualifications

Bachelor's degree plus 8+ years in federal cybersecurity policy, governance, or compliance.
Working knowledge of HHS IS2P, FISMA, NIST frameworks, and OMB M-22-09.
Experience applying ERM principles to security policy.
Excellent technical writing and policy-drafting skills.
Ability to obtain NIH suitability determination and PIV credential; fluent in English.

Responsibilities

Build the Single Policy Framework (Subtask 5.1): NIH ZTA policy, then standards by pillar, then implementation guides by workload family, then procedures, with an enterprise risk management (ERM) risk-appetite statement at the top.
Trace every policy statement up to its federal or HHS source and down to the Overlay control, architecture pattern, and governance checkpoint that enforce it.
Inventory NIH security policies, IS2P-derived standards, and procedures. Benchmark them against NIST SP 800-53 Rev 5, 800-207, 800-63-4, the CISA ZTMM, and current threats.
Develop policy anchors (Subtask 5.3), each made up of the policy statement, the technical setting that enforces it, the evidence that proves it, and the owner.
Write ZTA Policy Briefs and role-based monthly enterprise communications with the NIH ISAO Communications Team.
Align policy with AI governance (NIST AI RMF, OMB AI memoranda, HHS AI strategy) and with data-management requirements (NIH Data Management and Sharing Policy, Privacy Act, HIPAA where applicable).