Remote Security Lead: Federal Health Cloud & Compliance

COMMENCE; Virginia Beach (VA); Remote; USD 140,000 - 200,000; Full time

Job summary

Commence is seeking a Security Lead to establish and oversee the cybersecurity, privacy, and compliance posture for a CMS case management program. You will act as the security advisor to leadership, collaborating with cloud, DevSecOps, and government security stakeholders to embed security in every layer.

The role requires coordinating ATO activities, enforcing Zero Trust, and guiding secure cloud designs, IAM, and incident response for health data protection.

Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or related field.
• 10+ years of cybersecurity experience, including 2+ years supporting federal health programs.
• Experience securing cloud-based solutions, including AWS.

Responsibilities

• Lead the program's cybersecurity strategy and ensure compliance with CMS ARS, FISMA, HIPAA/HITECH, NIST 800-53, and FedRAMP requirements.
• Develop and maintain security plans, policies, and procedures aligned to federal standards.
• Support Authority to Operate (ATO) activities and coordinate with government security officials and compliance auditors.
• Manage Plan of Action and Milestones (POA&M) activities and maintain the program risk register.
• Review and approve AWS cloud architecture designs, ensuring secure implementation of cloud-native services and security controls.
• Enforce IAM policies, MFA, encryption at rest and in transit, network segmentation, and Zero Trust principles.
• Embed security controls into CI/CD pipelines and validate cloud configurations against security baselines.
• Implement automated scanning for source code, containers, Kubernetes workloads, Infrastructure as Code (IaC), and open-source dependencies.
• Conduct security risk assessments and threat modelling; identify vulnerabilities and develop mitigation strategies.
• Evaluate third-party and integration partner security risks.
• Define data classification, handling, retention, and destruction requirements to protect PII and PHI.
• Review interoperability and data-sharing solutions for HIPAA privacy compliance.
• Develop and maintain incident response procedures and support SIEM-based monitoring and alerting strategies.
• Coordinate response activities for security incidents and vulnerabilities.
• Participate in Architecture Review Boards (ARBs) and review application, integration, data, and infrastructure designs for security gaps.
• Ensure secure API and interoperability implementations across all integrated systems

Skills

Security leadership

CMS/Federal compliance

Cloud security (AWS)

Threat modelling

DevSecOps integration

IAM & Zero Trust

Education

Bachelor's degree in Cybersecurity/Information Security

Tools

AWS

Job description

Commence is seeking a Security Lead to establish and oversee the cybersecurity, privacy, and compliance posture for a CMS case management program. You will act as the security advisor to leadership, collaborating with cloud, DevSecOps, and government security stakeholders to embed security in every layer.

The role requires coordinating ATO activities, enforcing Zero Trust, and guiding secure cloud designs, IAM, and incident response for health data protection.