Healthcare IT Security Architect

Job Title: Senior IT Security Architect & Information System Security Officer

Location: Remote

The Senior IT Security Architect & Information System Security Officer bridges software delivery and enterprise risk management. This role ensures projects are architected securely from day one, minimizing compliance bottlenecks, protecting critical assets, and ensuring rapid, safe deployments. Acting as both the security designer and compliance lead, the position will govern security controls, lead authorization efforts, and guide engineering teams through risk mitigation.

Key Responsibilities & Deliverables:

• Security Architecture & System Design:

• Define and enforce security architecture standards across legacy and modern cloud/hybrid environments.
• Conduct threat modeling and risk assessments during initial project design phases to avoid costly security retrofits late in the delivery cycle.
• Establish secure identity and access management (IAM) strategies and modern authentication standards (e.g., SSO, MFA) to ensure authorized staff and external vendors have seamless, zero-trust access to critical applications without compromising data boundaries.
• Provide oversight and design standards for Disaster Recovery (DR) and incident response plans during initial project blueprints—ensuring business-critical Medicaid systems can rapidly recover from outages or cyber disruptions with minimal operational downtime.

• ISSO & Compliance Governance:

• Lead system compliance and authorization efforts aligned with CMS ARC-AMPE standards, including authoring and maintaining the System Security and Privacy Plan (SSPP), Risk Assessment Reports (RARs), and continuous Plan of Action & Milestones (POA&Ms) to ensure federal requirements are satisfied.
• Change Governance & Security Impact Analyses (SIA): Author, evaluate, and review formal Security Impact Analyses (SIAs) for planned enterprise technology (OET) modifications and new capabilities—ensuring system updates do not degrade existing security postures or disrupt live healthcare operations.
• Serve as the primary liaison for internal and external cybersecurity audits and compliance reviews (e.g., NIST SP 800-53, FedRAMP, CMMC, or ISO 27001).

• Continuous Monitoring & Risk Mitigation:

• Establish continuous security monitoring strategies to identify, track, and remediate vulnerabilities in real time.
• Translate technical vulnerabilities (e.g., CVEs, patch backlogs) into clear business risk terms for project leadership and executive stakeholders.

• Data Privacy & Healthcare Compliance:

• Architect end-to-end data encryption and strict access controls to safeguard sensitive citizen data—specifically Protected Health Information (PHI) and Personally Identifiable Information (PII)—ensuring compliance with HIPAA, CMS, and state privacy mandates.

• Cross-Functional Integration:

• Collaborate closely with DevOps and engineering teams to embed security automation into CI/CD pipelines (DevSecOps).
• Provide technical leadership and guidance to project teams to balance security controls with project velocity and system performance.
• Serve as the primary security bridge between project teams and executive leadership—ensuring full alignment with the Chief Information Security Officer (CISO) and Architecture Review Board (ARB) standards to eliminate compliance friction early in the development lifecycle.
• Partner directly with the program's CMS Certification lead to align technical security designs with evolving CMS certification criteria and federal guidance.

Qualifications

• Education: Bachelor’s Degree from an accredited college or university in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field. Master’s degree preferred.
• General Experience: Minimum of ten (10) years of experience in IT system planning, architecture, and security design.
• Specialized Security/ISSO Experience:

• Minimum of five (5) years directly performing ISSO functions, security architecture design, or leading system authorization efforts for complex, large-scale IT implementations.
• Demonstrated, hands-on experience authoring, updating, and defending security control baselines, System Security Plans (SSPs), and active POA&Ms under NIST SP 800-53 and CMS compliance frameworks—specifically with direct familiarity in CMS ARC-AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities) or the MARS-E to ARC-AMPE transition; candidates must be comfortable producing clear, audit-ready regulatory documentation as a regular deliverable.

• Certifications (Preferred): Active industry certifications such as CISSP, CISM, ISSAP, or Certified Cloud Security Professional (CCSP).