Job Description & Details
This is a heavy-hitting governance and architecture role sitting right at the intersection of enterprise risk management and modern software delivery. You won't just be writing policies; you'll be actively embedding security into cloud-native and legacy environments while owning federal compliance frameworks.
What You'll Actually Be Doing
Your day-to-day will be a mix of high-level system architecture design and rigorous compliance management. You'll lead threat modeling sessions during the earliest phases of project design to prevent costly security retrofits, while simultaneously authoring critical authorization documents like SSPPs, RARs, and POA&Ms. Expect to spend a significant amount of time partnering with DevOps to bake DevSecOps practices into CI/CD pipelines, translating technical vulnerabilities into plain-English business risks for executive stakeholders, and acting as the primary liaison for federal audits.
The Core Tech Stack
You must live and breathe NIST SP 800-53 and CMS compliance standards—specifically CMS ARC-AMPE. Since this deals heavily with healthcare data, your background needs to prove deep expertise in handling PHI and PII under strict HIPAA mandates. On the architectural side, you'll need solid command over zero-trust IAM strategies, SSO, MFA, and automated vulnerability management tooling integrated directly into cloud and hybrid CI/CD workflows.
Interview Expectations
Expect the hiring team to push you on a scenario where a critical system update breaks a live healthcare deployment just days before a federal audit, forcing you to balance velocity with strict compliance baselines. They will also likely drill down into how you handle continuous POA&Ms and translate complex CVE backlogs into actionable risk metrics for non-technical executives who only care about delivery speed.
Application Advice
To get past the ATS, your resume needs to explicitly feature keywords like 'CMS ARC-AMPE', 'NIST SP 800-53', 'POA&M', and 'Security Impact Analysis (SIA)'. Don't just list these frameworks; write bullet points that demonstrate how you authored audit-ready documentation and successfully guided large-scale engineering teams through complex federal system authorizations without killing project velocity.