Governance and Compliance Consultant

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in compliance assessments and prepare for audit-readiness activities related to CMS ARC-AMPE, HITRUST r2, SSA regulatory compliance audits, and other relevant requirements.

• Gather evidence, liaise with assessors, and address findings.

• Analyze security and compliance requirements while assessing existing control documentation and its implementation.

• Detect deficiencies in policies, procedures, standards, and supporting documentation.

• Review, revise, and create security policies, standards, guidelines, and associated documentation.

• Partner with agency security analysts and operational teams to establish, document, and enhance security procedures.

• Determine necessary objective evidence and assess its relevance, completeness, accuracy, and timeliness.

• Collaborate with control owners to gather and sustain supporting artifacts.

• Maintain relationships between regulatory requirements, security controls, policies, procedures, responsible parties, and objective evidence.

• Document deficiencies in control and documentation, suggest corrective measures, and monitor remediation efforts until resolved.

• Work alongside security, infrastructure, cloud, application, data, and business teams to confirm control implementation and enhance compliance documentation, evidence collection, and assessment processes.

⛳️ Requirements

• Professional experience in cybersecurity, information security, governance, risk, compliance, IT auditing, security architecture, or a closely related field.

• Proven experience in interpreting security or compliance requirements and converting them into actionable controls, documentation, procedures, or evidence needs.

• Experience in reviewing, developing, or maintaining information security policies, standards, procedures, and related governance documentation.

• Experience conducting security control assessments, compliance assessments, gap analyses, or audit-readiness activities.

• Working knowledge of cybersecurity control frameworks and concepts in security risk management.

• Ability to effectively communicate security and compliance requirements to both technical and non-technical audiences.

• Strong writing skills capable of producing clear, defensible, and assessment-ready documentation.

• Excellent analytical and organizational skills, including the ability to handle multiple controls, findings, evidence requests, and remediation efforts simultaneously.

• Capacity to work independently on defined compliance tasks while effectively collaborating with security analysts, technical teams, leadership, auditors, and assessors.

• Experience in state Medicaid, healthcare, government, or another highly regulated sector.

• Direct experience with CMS ARC-AMPE, HITRUST CSF or HITRUST r2 assessments, SSA regulatory compliance audits, NIST SP 800-53, NIST Cybersecurity Framework, or CMS/Medicaid security and compliance mandates.

• Familiarity with HITRUST ai2 assessments and their associated security and compliance requirements.

• Experience in developing control crosswalks or mapping requirements across various security and compliance frameworks.

• Experience assisting in formal audits, third-party evaluations, certification processes, or regulatory reviews.

• Familiarity with cloud and enterprise technology environments sufficient to comprehend how technical controls are implemented and evidenced.

• Experience collaborating with security analysts, system owners, application teams, infrastructure teams, cloud teams, and other control owners to document security processes.

• Familiarity with governance, risk, and compliance tools or structured compliance evidence repositories.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance plans.

• Generous paid time off and holiday schedule.

• Opportunities for professional development and career growth.

• Collaborative and supportive work environment.