Drive vulnerability management (scan triage, remediation SLAs, patch governance) and configuration baselines (e.g., DISA STIGs, CIS Benchmarks, SCAP).• Compliance, Risk Management Framework (RMF) and Audit Readiness• Lead end to end Risk Management Framework (RMF) activities (NIST SP 800 37), including security categorizations, control tailoring, System Security Plan (SSP), security assessment, POA&Ms, and continuous monitoring to sustain ATO.• Ensure compliance with HIPAA Security Rule (45 CFR §164) for PHI, CMS Acceptable Risk Safeguards (ARS), OMB Circular A 130, and HHS policies.• Proven experience with NIST SP 800 53, RMF (NIST SP 800 37), FIPS 199/200, HIPAA Security Rule, OMB A 130, and CMS policy frameworks (e.g., CMS ARS).• Hands-on with SIEM/EDR, vulnerability management, cloud security architectures (AWS GovCloud/Azure Government), network segmentation, zero trust principles, and DevSecOps tooling.•