Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 days ago

Security Compliance Engineer

Altarum8 open roles

Pay
$100,207 – $120,939 a year
Where
Novi, MI
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity Compliance EngineerAltarum · Novi, MI

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Altarum's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

9.8% of postings close within 7 days. Measured by our own scanner across the market. Altarum postings stay open a median of 31 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.9%3 days
  3. 9.8%7 days
  4. 15.6%14 days
  5. 33.8%30 days
This job: posted 8 days ago

Altarum median: 31 days open

The posting

At Altarum, we’re driven by a simple but powerful mission: improving the health of individuals with fewer financial resources and populations underserved by the healthcare system. We partner with federal and state agencies to design and deliver solutions that make a real, measurable difference.

About the Role

What You'll Do

  • Work with the SAG and Senior Cybersecurity Policy Advisor to maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), the Incident Response (IR) Plan, and related policies, procedures, and evidence
  • Prepare ATO packages and serve as the primary point of contact for client security offices, third-party assessors (3PAOs and C3PAOs), and auditors
  • Within the SAG's existing process, maintain our NIST SP 800-171 self-assessment and SPRS score, keeping evidence audit-ready for CMMC and client assessments
  • Track compliance with federal (FedRAMP, CMMC) and state (TX-RAMP, StateRAMP/GovRAMP) security programs for platforms serving government clients
  • Support proposals from a security perspective: review solicitation security requirements, write security and compliance sections, and answer client and vendor security questionnaires from a maintained, reusable response library
  • Run an ongoing continuous monitoring program across in-scope systems, including periodic control checks, scan review, and POA&M updates
  • Conduct internal control assessments and readiness reviews ahead of external assessments
  • Report compliance posture to leadership on a regular cadence, with clear metrics, trends, and risk-based recommendations
  • Manage our vendor-maintained SOC, Managed Detection and Response (MDR) service, and SIEM (24/7/365), including detection tuning, escalations, service performance, and reporting
  • Run the vulnerability and patch management program, coordinating fixes with system administrators, developers, and vendors and verifying closure within defined timelines
  • Conduct regular access reviews across all environments, enforcing least privilege for users and privileged accounts
  • Review changes for security impact through our change enablement process
  • Review the security posture of new platforms, vendors, and subcontractors before onboarding, and monitor them for supply chain risk, flow-down requirements, and current FedRAMP or state authorizations
  • Partner with the PHT team to build security controls into CI/CD pipelines, such as automated vulnerability scanning, secrets management, and dependency checks
  • Review infrastructure-as-code (Terraform, CloudFormation, or similar) and cloud configurations in AWS, Azure, Oracle, and other cloud environments against compliance baselines, and recommend hardening
  • Support secure configuration and monitoring of cloud environments used for client system delivery
  • Advise on container and image security practices where applicable
  • Serve as the security and compliance point of contact in the PHT team's working cadence, including sprint reviews, change management, and release planning
  • Support incident response, including triage coordination with the MDR, SIEM, and other relevant vendors; coordinating containment with system administrators and engineers; documentation and evidence preservation; and client notification and required government reporting
  • Facilitate IR tabletop exercises and feed after-action improvements back into the IR Plan
  • Maintain an inventory of approved AI tools, monitor for unapproved use, and apply data loss protections so PHI, PII, and CUI don't reach unapproved services
  • Support AI vendor risk reviews and align AI practices with the NIST AI RMF and NIST's draft SP 800-53 control overlays for AI systems

What You'll Bring

  • 5+ years in information security, including at least 2 years in a compliance-focused role supporting NIST 800-171, NIST 800-53, FedRAMP, or HIPAA
  • Familiarity with cloud infrastructure security in AWS, Oracle, and/or Azure
  • CompTIA Security+ or a higher certification, such as SSCP, CGRC (formerly CAP), CISSP, or CISM
  • Bachelor's degree in a related field, or equivalent experience
  • U.S. citizenship and the ability to obtain and maintain Public Trust eligibility

Preferred qualifications

  • CMMC Certified Professional (CCP), or willingness to obtain it within 12 months of hire
  • A cloud security certification, such as AWS Certified Security – Specialty or Microsoft Azure Security Engineer Associate
  • Experience in consulting, professional services, or government contracting serving healthcare, state, or federal clients
  • Experience with federal or state security programs such as FedRAMP, CMMC, TX-RAMP, or StateRAMP (now GovRAMP)
  • Hands-on experience with CI/CD tooling (GitHub Actions, GitLab CI, or Jenkins) and infrastructure-as-code (Terraform, CloudFormation, or Puppet)
  • Experience with a GRC platform and with scripting (PowerShell, Python, or Bash) to automate evidence collection and reporting

Why Join Our Team?

Where You'll Work

  • Hybrid in Novi, MI with occasional in-person collaboration days
  • If you’re near one of our offices (Arlington, VA; Silver Spring, MD; or Novi, MI), you’ll join us in person one day every other month (6 times per year) for a fun, purpose-driven Collaboration Day. These days are filled with creative energy, meaningful connection, and team brainstorming.
  • Non-local employees will join these days virtually and may be asked to join us occasionally in-person.

Work Eligibility & Requirements

  • Candidates must be currently eligible to work in the United States; sponsorship is not available.
  • All work must be performed within the continental U.S. for the duration of employment, unless required by contract.
  • Ability to work core hours aligned with Eastern Time, unless otherwise approved by your manager.
  • Remote employees must maintain a dedicated, ergonomically appropriate workspace free from distractions, with reliable internet and a mobile device that supports efficient work.
  • Travel Requirements: <10%

Altarum is a nonprofit organization focused on improving the health of individuals with fewer financial resources and populations disenfranchised by the health care system. We work primarily on behalf of federal and state governments to design and implement solutions that achieve measurable results. We combine our expertise in public health and health care delivery with technology development and implementation, practice transformation, training and technical assistance, quality improvement, data analytics, and applied research and evaluation. Our innovative solutions and proven processes lead to better value and health for all.

Altarum is an equal opportunity employer that provides employment and opportunities to all qualified employees and applicants without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, or any other characteristic protected by applicable law.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Altarum's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Altarum's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Altarum's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.