Information Systems Security Manager – ISSM

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in compliance assessments and activities related to audit readiness for CMS ARC-AMPE, HITRUST r2, SSA regulatory compliance audits, and other relevant requirements, including preparation of evidence, coordination with assessors, and addressing findings.

• Analyze security and compliance requirements, assess current control documentation and implementation, and pinpoint deficiencies in policies, procedures, standards, and supporting evidence.

• Review, enhance, and create security policies, standards, guidelines, and associated documentation.

• Collaborate with agency security analysts and operational teams to create, document, and refine security procedures that reflect operational practices and control implementation.

• Identify necessary objective evidence and assess its relevance, completeness, accuracy, and timeliness.

• Work with control owners to gather and sustain supporting artifacts.

• Maintain connections between regulatory requirements, security controls, policies, procedures, responsible stakeholders, and objective evidence.

• Document deficiencies in control and documentation, recommend corrective actions, and work with stakeholders to monitor remediation until resolution.

• Collaborate with security, infrastructure, cloud, application, data, and business teams to verify control implementation and enhance compliance documentation, evidence collection, and assessment processes.

⛳️ Requirements

• Professional background in cybersecurity, information security, governance, risk, compliance, IT audit, security architecture, or a closely related field.

• Proven experience interpreting security or compliance requirements and converting them into actionable controls, documentation, procedural, or evidence requirements.

• Experience in reviewing, developing, or maintaining information security policies, standards, procedures, and related governance documentation.

• Experience conducting security control assessments, compliance assessments, gap analyses, or audit readiness activities.

• Working knowledge of cybersecurity control frameworks and concepts of security risk management.

• Ability to effectively communicate security and compliance requirements to both technical and non-technical stakeholders.

• Strong written communication abilities with a talent for producing clear, defensible, and assessment-ready documentation.

• Excellent analytical and organizational skills, including the capacity to manage multiple controls, findings, evidence requests, and remediation tasks simultaneously.

• Ability to independently handle defined compliance assignments while working collaboratively with security analysts, technical teams, leadership, auditors, and assessors.

• Preferred: Experience in supporting state Medicaid, healthcare, government, or other highly regulated environments.

• Preferred: Direct experience with CMS ARC-AMPE, HITRUST CSF or HITRUST r2 assessments, SSA regulatory compliance audits, NIST SP 800-53, NIST Cybersecurity Framework, or CMS/Medicaid security and compliance requirements.

• Preferred: Familiarity with HITRUST ai2 assessments and related security and compliance requirements.

• Preferred: Experience in developing control crosswalks or mapping requirements across various security and compliance frameworks.

• Preferred: Experience assisting with formal audits, third-party assessments, certification activities, or regulatory reviews.

• Preferred: Familiarity with cloud and enterprise technology environments sufficient to understand the implementation and evidence of technical controls.

• Preferred: Experience collaborating with security analysts, system owners, application teams, infrastructure teams, cloud teams, and other control owners to document security processes.

• Preferred: Familiarity with governance, risk, and compliance tools or structured compliance evidence repositories.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Flexible work hours and remote working opportunities.

• Professional development and training programs.

• Retirement savings plan with employer matching.

• Generous paid time off and holidays.