[Remote] Governance and Compliance Consultant

Note: The job is a remote job and is open to candidates in USA. Random Bit LLC is hiring a Governance and Compliance Consultant to support a state Medicaid agency’s Enterprise Security & Compliance team. The role provides cybersecurity governance, risk, and compliance support, including regulatory assessments, control validation, audit readiness, documentation management, and remediation.

Responsibilities

• Support compliance assessments and audit-readiness activities for CMS ARC-AMPE, HITRUST r2, SSA regulatory compliance audits, and other applicable requirements, including evidence preparation, assessor coordination, and responses to findings
• Interpret security and compliance requirements, evaluate existing control documentation and implementation, and identify gaps in policies, procedures, standards, and supporting evidence
• Review, update, and develop security policies, standards, guidelines, and related documentation to address applicable security and compliance requirements
• Collaborate with agency security analysts and operational teams to develop, document, and improve security procedures that accurately reflect operational practices and control implementation
• Identify required objective evidence, evaluate its relevance, completeness, accuracy, and currency, and coordinate with control owners to obtain and maintain appropriate supporting artifacts
• Maintain mappings between regulatory requirements, security controls, policies, procedures, responsible stakeholders, and objective evidence to demonstrate compliance and support assessments
• Document identified control and documentation deficiencies, recommend corrective actions, and collaborate with responsible stakeholders to develop and track remediation activities through resolution
• Work with security, infrastructure, cloud, application, data, and business teams to validate control implementation and improve compliance documentation, evidence collection, and assessment processes

Skills

• Professional experience in cybersecurity, information security, governance, risk, compliance, IT audit, security architecture, or a closely related discipline
• Demonstrated experience interpreting security or compliance requirements and translating them into actionable control, documentation, procedural, or evidence requirements
• Experience reviewing, developing, or maintaining information security policies, standards, procedures, and related governance documentation
• Experience performing security control assessments, compliance assessments, gap analyses, or audit-readiness activities
• Working knowledge of cybersecurity control frameworks and security risk management concepts
• Ability to communicate security and compliance requirements effectively to both technical and non-technical stakeholders
• Strong written communication skills with the ability to create clear, defensible, and assessment-ready documentation
• Strong analytical and organizational skills, including the ability to manage multiple controls, findings, evidence requests, and remediation activities concurrently
• Ability to work independently on defined compliance assignments while collaborating effectively with security analysts, technical teams, leadership, auditors, and assessors
• Experience supporting state Medicaid, healthcare, government, or another highly regulated environment
• Direct experience with one or more of the following: + CMS ARC-AMPE + HITRUST CSF or HITRUST r2 assessments + SSA regulatory compliance audits + NIST SP 800-53 + NIST Cybersecurity Framework + CMS or Medicaid security and compliance requirements
• Familiarity with HITRUST ai2 assessments and associated security and compliance requirements
• Experience developing control crosswalks or mapping requirements across multiple security and compliance frameworks
• Experience supporting formal audits, third-party assessments, certification activities, or regulatory reviews
• Familiarity with cloud and enterprise technology environments sufficient to understand how technical controls are implemented and evidenced
• Experience working with security analysts, system owners, application teams, infrastructure teams, cloud teams, and other control owners to document security processes
• Familiarity with governance, risk, and compliance tools or structured compliance evidence repositories

Benefits

• Remote work

Company Overview