{"id":2541353,"url":"https://alion.io/job/altarum-security-compliance-engineer","title":"Security Compliance Engineer","company":{"id":671929,"name":"Altarum","domain":"altarum.org","url":"https://alion.io/company/altarum","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Legal","role_family":"Legal","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Novi, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":100207,"max":120939,"currency":"USD","period":"year","gross":null,"usd_annual":120939},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"FedRAMP","optional":false},{"name":"HIPAA","optional":false},{"name":"ITIL","optional":false},{"name":"Least Privilege","optional":false},{"name":"NIST 800-171","optional":false},{"name":"NIST 800-53","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"SIEM","optional":false},{"name":"Terraform","optional":false},{"name":"GitHub Actions","optional":true},{"name":"GitLab CI","optional":true},{"name":"Jenkins","optional":true},{"name":"PowerShell","optional":true},{"name":"Puppet","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-07T20:19:24Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-14T22:38:01Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"At Altarum, we’re driven by a simple but powerful mission: improving the health of individuals with fewer financial resources and populations underserved by the healthcare system. We partner with federal and state agencies to design and deliver solutions that make a real, measurable difference.\nAbout the Role\nYou will own Altarum's security compliance and assurance program. The role blends governance, risk, and compliance (GRC) with hands-on security operations and engineering. We protect Personally Identifiable Information (PII), Protected Health Information (PHI), and Controlled Unclassified Information (CUI) every day, and you will help make sure that work is defensible and audit-ready.\nYou will report to the Director of Security and Technology. You'll work closely with our Security Advisory Group (SAG) and Senior Cybersecurity Policy Advisor, support client Authority to Operate (ATO) efforts, and serve as the security and compliance partner to our Public Health Technology (PHT) team.\nYou will work across these frameworks: NIST SP 800-171 and CMMC Level 2, NIST SP 800-53 Rev 5, FedRAMP Low and Moderate, TX-RAMP and StateRAMP (now GovRAMP), the HIPAA Security Rule, and the NIST AI Risk Management Framework. Day-to-day practices align with ITIL 4.\nWhat You'll Do\nCompliance documentation and authorization support\nWork with the SAG and Senior Cybersecurity Policy Advisor to maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence\nPrepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors (3PAOs and C3PAOs), and auditors\nWithin the SAG's existing process, maintain our NIST SP 800-171 self-assessment and SPRS score, keeping evidence audit-ready for CMMC and client assessments\nTrack compliance with federal (FedRAMP, CMMC) and state (TX-RAMP, StateRAMP/GovRAMP) security programs for platforms serving government clients\nSupport proposals from a security perspective: review solicitation security requirements, write security and compliance sections, and answer client and vendor security questionnaires from a maintained, reusable response library\nContinuous monitoring and control assessment\nRun an ongoing continuous monitoring program across in-scope systems, including periodic control checks, scan review, and POA&M updates\nConduct internal control assessments and readiness reviews ahead of external assessments\nReport compliance posture to leadership on a regular cadence, with clear metrics, trends, and risk-based recommendations\nSecurity operations\nManage our vendor-maintained SOC, Managed Detection and Response (MDR) service, and SIEM (24/7/365), including detection tuning, escalations, service performance, and reporting\nRun the vulnerability and patch management program, coordinating fixes with system administrators, developers, and vendors and verifying closure within defined timelines\nConduct regular access reviews across all environments, enforcing least privilege for users and privileged accounts\nReview changes for security impact through our change enablement process\nReview the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor them for supply chain risk, flow-down requirements, and current FedRAMP or state authorizations\nDevOps and engineering support\nPartner with the PHT team to build security controls into CI/CD pipelines, such as automated vulnerability scanning, secrets management, and dependency checks\nReview infrastructure-as-code (Terraform, CloudFormation, or similar) and cloud configurations in AWS, Azure, Oracle, and other cloud environments against compliance baselines, and recommend hardening\nSupport secure configuration and monitoring of cloud environments used for client system delivery\nAdvise on container and image security practices where applicable\nServe as the security and compliance point of contact in the PHT team's working cadence, including sprint reviews, change management, and release planning\nIncident response\nSupport incident response, including triage coordination with the MDR, SIEM, and other relevant vendors; coordinating containment with system administrators and engineers; documentation and evidence preservation; and client notification and required government reporting\nFacilitate IR tabletop exercises and feed after-action improvements back into the IR Plan\nAI security and governance\nMaintain an inventory of approved AI tools, monitor for unapproved use, and apply data loss protections so PHI, PII, and CUI don't reach unapproved services\nSupport AI vendor risk reviews and align AI practices with the NIST AI RMF and NIST's draft SP 800-53 control overlays for AI systems\nWhat You'll Bring\n5+ years in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA\nFamiliarity with cloud infrastructure security in AWS, Oracle, and/or Azure\nCompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM\nBachelor's degree in a related field, or equivalent experience\nU.S. citizenship and the ability to obtain and maintain Public Trust eligibility\nPreferred qualifications\nCMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire\nA cloud security certification, such as AWS Certified Security - Specialty or Microsoft Azure Security Engineer Associate\nExperience in consulting, professional services, or government contracting serving healthcare, state, or federal clients\nExperience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP (now GovRAMP)\nHands-on experience with CI/CD tooling (GitHub Actions, GitLab CI, or Jenkins) and infrastructure-as-code (Terraform, CloudFormation, or Puppet)\nExperience with a GRC platform and with scripting (PowerShell, Python, or Bash) to automate evidence collection and reporting\nWhy Join Our Team?\nAltarum is a nonprofit organization headquartered in Ann Arbor, Michigan. We create and implement solutions to advance health among vulnerable and publicly insured populations. Our public sector clients include the U.S. Department of Defense, the Department of Health and Human Services, the Department of Agriculture, the Department of Veterans Affairs, the Occupational Safety and Health Administration, and various state agencies nationwide.\nWe also serve clients in the philanthropic and private sectors. Our areas of expertise include health data and analytics; value-based care; public health systems design, development, and information exchange; behavioral health and substance use disorders; childhood and adolescent health; medical education; food and nutrition; consumer engagement; elder care; health disparities and equity; and military and veterans' health.\nWhere You'll Work\n Hybrid in Novi, MI with occasional in-person collaboration days\nIf you’re near one of our offices (Arlington, VA; Silver Spring, MD; or Novi, MI), you’ll join us in person one day every other month (6 times per year) for a fun, purpose-driven Collaboration Day. These days are filled with creative energy, meaningful connection, and team brainstorming.\nNon-local employees will join these days virtually and may be asked to join us occasionally in-person.\nWork Eligibility & Requirements\n Candidates must be currently eligible to work in the United States; sponsorship is not available.\nAll work must be performed within the continental U.S. for the duration of employment, unless required by contract.\nAbility to work core hours aligned with Eastern Time, unless otherwise approved by your manager.\nRemote employees must maintain a dedicated, ergonomically appropriate workspace free from distractions, with reliable internet and a mobile device that supports efficient work.\nTravel Requirements:","description_format":"text","description_chars":7910,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Compliance","Research Institutes","Public Health & Prevention"],"lifecycle":[{"event":"open","at":"2026-10-14T15:42:42Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":7,"expected_fill_days":38,"reasons":["conf:2","win:early"],"computed_at":"2026-10-15T00:44:56Z"},"pay":{"stated_usd_annual":120939,"is_top_pay":false},"html_url":"https://alion.io/job/altarum-security-compliance-engineer","json_url":"https://alion.io/job/altarum-security-compliance-engineer.json","meta":{"generated_at":"2026-10-15T00:44:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":866,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":671929},"rest":"https://alion.io/mcp/rest/get_company?id=671929"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faltarum-security-compliance-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faltarum-security-compliance-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faltarum-security-compliance-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/altarum-security-compliance-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faltarum-security-compliance-engineer"}]}