[Hiring] Governance and Compliance Consultant @Random Bit

Role Description

The Governance and Compliance Consultant supports a state Medicaid agency’s Enterprise Security & Compliance team by providing cybersecurity governance, risk, and compliance (GRC) support across regulatory assessments, security control validation, audit readiness, documentation management, and remediation activities.

This role works closely with agency security analysts, technology teams, business stakeholders, leadership, and assessment teams to evaluate the agency’s compliance posture against frameworks and assessment requirements, including:

• CMS ARC-AMPE
• HITRUST r2
• SSA regulatory compliance audits

The Governance and Compliance Consultant translates security and compliance requirements into actionable documentation, control expectations, procedures, and objective evidence requirements while identifying and helping remediate gaps that could affect assessment readiness.

Qualifications

• Professional experience in cybersecurity, information security, governance, risk, compliance, IT audit, security architecture, or a closely related discipline.
• Demonstrated experience interpreting security or compliance requirements and translating them into actionable control, documentation, procedural, or evidence requirements.
• Experience reviewing, developing, or maintaining information security policies, standards, procedures, and related governance documentation.
• Experience performing security control assessments, compliance assessments, gap analyses, or audit-readiness activities.
• Working knowledge of cybersecurity control frameworks and security risk management concepts.
• Ability to communicate security and compliance requirements effectively to both technical and non-technical stakeholders.
• Strong written communication skills with the ability to create clear, defensible, and assessment-ready documentation.
• Strong analytical and organizational skills, including the ability to manage multiple controls, findings, evidence requests, and remediation activities concurrently.
• Ability to work independently on defined compliance assignments while collaborating effectively with security analysts, technical teams, leadership, auditors, and assessors.

Requirements

• Experience supporting state Medicaid, healthcare, government, or another highly regulated environment.
• Direct experience with one or more of the following:
• CMS ARC-AMPE
• HITRUST CSF or HITRUST r2 assessments
• SSA regulatory compliance audits
• NIST SP 800-53
• NIST Cybersecurity Framework
• CMS or Medicaid security and compliance requirements
• Familiarity with HITRUST ai2 assessments and associated security and compliance requirements.
• Experience developing control crosswalks or mapping requirements across multiple security and compliance frameworks.
• Experience supporting formal audits, third-party assessments, certification activities, or regulatory reviews.
• Familiarity with cloud and enterprise technology environments sufficient to understand how technical controls are implemented and evidenced.
• Experience working with security analysts, system owners, application teams, infrastructure teams, cloud teams, and other control owners to document security processes.
• Familiarity with governance, risk, and compliance tools or structured compliance evidence repositories.