Security Manager

POSITION TITLE: Security Manager LOCATION: Remote CLEARANCE: Must be able to obtain aHigh-RiskPublic Trust COMPANY OVERVIEW At APV, weremore than a technology company werea mission-driven powerhouse transforming organizations through advanced technology and human ingenuity. Ourexpertisespans AI/ML, data architecture, low-code/no-code development, AgileDevSecOps, and cloud services, delivering scalable and meaningful solutions. In our Emerging Technology Lab, innovation drives progress. Our teams create intelligent chatbots, AI-powered assistants, robotic process automation (RPA), essay graders, and data analytics platforms. Ifyourepassionate about solving complex challenges and shaping the future, APV is the place for you. Since 2007, wevepartnered with federal and state agencies to deliver IT, training, and consulting solutions that achieve mission-critical outcomes. Built on accountability, integrity, and quality, we go beyond expectations.With 70+ prime contracts and a proven record of client success, APV continues to grow andwerelooking for exceptional talent to grow with us. At APV, we Always Provide Value POSITION SUMMARY Seeking a mission-driven Security Manager to support a large-scale federal healthcare technology program. This role provides leadership across cybersecurity, compliance, risk management, continuous monitoring, incident response, and federal security governance. DUTIES Lead security strategy, compliance, risk management, and continuous monitoring activities for complex federal information systems.Maintain ATO documentation, security artifacts, assessments, and authorization support packages.Oversee vulnerability management, POA& M development, remediation tracking, and security reporting.Coordinate security assessments, audits, penetration testing, and continuous monitoring activities.Ensure compliance with NIST RMF, NIST 800-53, FISMA, HIPAA, CMS security requirements, and federal cybersecurity standards.Support incident response, threat management, and security operations activities.Collaborate with architects, DevSecOps teams, developers, and government stakeholders to integrate security controls throughout the system lifecycle.Own the System Security Plan, security control assessments, and Authority to Operate (ATO) package, including support for reauthorization and for extending authorization to lower environments.Manage the POA& M lifecycle end to end: intake, risk rating, remediation planning, evidence, and closure within agency-defined timelines, with monthly reporting to government stakeholders.Apply NIST RMF, NIST SP 800-53, FISMA, HIPAA, and agency-specific control baselines such as CMS Acceptable Risk Safeguards (ARS) to a cloud-hosted AWS environment.Coordinate independent assessments, penetration testing, and continuous monitoring, and serve as the primary security interface to government security and privacy officials.Work shoulder to shoulder with the DevSecOps Lead so that scanning, patching, and control evidence are automated in the pipeline instead of collected by hand. EDUCATION Bachelors degree in Cybersecurity, Computer Science, Information Systems, or a related discipline. REQUIRED QUALIFICATIONS Minimum 8 years of information security/cybersecurity experience, including at least 3 years leading security activities for complex information systems.Demonstrated knowledge of NIST Risk Management Framework (RMF), NIST SP 800-53, FISMA, continuous monitoring, vulnerability management, incident response, security assessments, POA& M management, and system authorization processes. Ability to integrate security requirements and controls throughout the system development lifecycle and coordinate security activities with Government stakeholders.Must be able to obtain and maintain a High-Risk Public Trust or equivalent federal client access.This role supports sensitive federal programs and involves elevated access to systems and data. Position requires the current ability to obtain and maintain required access without interruption in alignment with long-term program needs. Mustbe authorized towork in the United States without employer sponsorship now or in the future. PREFERRED QUALIFICATIONS CISSP, CISM, CGRC, or equivalent cybersecurity credentials. Direct experience with CMS or HHS authorization processes, CFACTS, the CMS Acceptable Risk Safeguards (ARS), FedRAMP-authorized cloud services, and HIPAA/PHI environments is strongly preferred. ABOUT APV APV is an Equal Employment Opportunity employer. All qualified applicants are considered without regard to race, color, religion, sex, national origin, age, disability, genetic information, sexual orientation, gender identity, veteran status, or marital status.