Project Security Lead

The Project Security Lead will own security and compliance for the PACT implementation and will be responsible for assuring security throughout application development, configuration, implementation, deployment, maintenance, and upgrades. Key Responsibilities

• Serve as security lead across the complete PACT lifecycle.
• Certify in writing the security of each applicable deliverable, as required by the RFP.
• Integrate security controls into application architecture, development/configuration, integrations, testing, deployment, and operations.
• Ensure alignment with HIPAA Privacy and Security Rules.
• Support NIST SP 800-53 Rev. 5 Moderate baseline controls.
• Support CMS Acceptable Risk Safeguards (ARS).
• Address 42 CFR Part 2 requirements where applicable.
• Validate TLS 1.2+ encryption in transit and FIPS-validated encryption at rest.
• Review RBAC, least privilege, segregation of duties, SSO, MFA, session controls, and user provisioning.
• Coordinate application vulnerability scans, vulnerability remediation, patching, penetration testing, and POA&M updates.
• Support incident-response and breach-notification procedures.
• Review application, data, integration, Azure, DevOps, and deployment security.
• Maintain security evidence needed for State/BIT review and acceptance.
• Work with the Technical Lead and DevOps Engineer to incorporate security into the SDLC and release process.

• 8+ years of information/application security experience.
• Healthcare/public-sector security experience strongly preferred.
• Experience with HIPAA, NIST 800-53, CMS ARS, IAM/RBAC, vulnerability management, and cloud security.
• Microsoft Azure security experience preferred.
• Application-security/DevSecOps experience.
• CISSP, CISM, CCSP, or equivalent certification preferred.