Information Privacy and Security, Advisor
Peraton · Woodlawn, MD, US
About this role
## Information Privacy and Security Advisor ### Responsibilities - Lead security engineering, governance, risk, and compliance activities for mission-critical federal systems. - Own security architecture and control implementation across application, infrastructure, and cloud layers aligned to **NIST SP 800-53**, **FIPS 199/200**, and **CMS security policies**. - Drive **vulnerability management** (scan triage, remediation SLAs, patch governance) and manage **configuration baselines** (e.g., **DISA STIGs**, **CIS Benchmarks**, **SCAP**). - Lead end-to-end **Risk Management Framework (RMF)** activities (NIST SP 800-37) to sustain **Authority to Operate (ATO)**, including security categorizations, control tailoring, **System Security Plan (SSP)**, security assessments, **POA&Ms**, and continuous monitoring. - Ensure compliance with **HIPAA Security Rule (45 CFR §164)** for **PHI**, **CMS Acceptable Risk Safeguards (ARS)**, **OMB Circular A-130**, and **HHS** policies. - Coordinate internal/external audits (IG, CMS, third-party assessors), including evidence collection and control testing; maintain strong documentation. - Lead the incident response lifecycle for **PHI/PII** incidents: triage, containment, eradication, recovery, forensics coordination, root cause analysis, and required notifications/reporting. - Manage access control, identity, **MFA**, privileged access, security vulnerabilities, and continuous monitoring dashboards. - Ensure reliable backup/restore and support disaster recovery exercises. - Enforce data classification, encryption (in transit/at rest), key management, and tokenization aligned with CMS/HHS requirements. - Maintain risk registers and provide monthly security status reporting to CMS stakeholders. - Translate complex security concepts into clear, actionable guidance for technical and non-technical audiences. - Collaborate with Program Management, Engineering, QA, Operations, and CMS counterparts. - Support security requirements for contract renewals and new contract bids. ### Qualifications - Minimum **8 years** with **BS/BA**; **6 years** with **MS/MA**; **3 years** with **PhD**. - Experience in cybersecurity across engineering, compliance, and operations. - **3+ years** in security leadership/management on federal programs. - Proven experience with **NIST SP 800-53**, **RMF (NIST SP 800-37)**, **FIPS 199/200**, **HIPAA Security Rule**, **OMB A-130**, and **CMS** policy frameworks (e.g., **CMS ARS**). - Hands-on experience with **SIEM/EDR**, vulnerability management, cloud security architectures (**AWS GovCloud/Azure Government**), network segmentation, **zero trust**, and **DevSecOps** tooling. - Strong documentation skills (e.g., **SSP, IS RA, SAR, POA&M, Contingency Plans, runbooks, playbooks**) and audit engagement. ### Preferred Qualifications - Certifications: **CISSP, CISM, CAP, CCSP, CASP+, Security+** (or equivalent). - Cloud security certs (e.g., **AWS Security Specialty**, **Azure Security Engineer Associate**). - Experience with **TIC 3.0**, **NIST SP 800-63**, **NIST SP 800-30**, configuration baselines (**DISA STIGs/CIS**), and **FedRAMP-aligned** controls. - Background in large-scale healthcare/Medicare environments and **PHI/PII** safeguarding. - Familiarity with continuous ATO, automated compliance (policy-as-code), and modern IaC pipelines. ### Requirements - **US Citizen** - Ability to obtain a **Public Trust** clearance - Problem-solving mindset; able to take initiative and work indepe
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.