Security Manager

POSITION TITLE:Security Manager LOCATION:Remote CLEARANCE:Must be able to obtain aHigh-RiskPublic Trust COMPANY OVERVIEW At APV,weremore than a technology company werea mission-driven powerhouse transforming organizations through advanced technology and human ingenuity.

Ourexpertisespans AI/ML, data architecture, low-code/no-code development, AgileDevSecOps, and cloud services, delivering scalable and meaningful solutions.

In our Emerging Technology Lab, innovation drives progress.

Our teams create intelligent chatbots, AI-powered assistants, robotic process automation (RPA), essay graders, and data analytics platforms.

Ifyourepassionate about solving complex challenges and shaping the future, APV is the place for you.

Since 2007,wevepartnered with federal and state agencies to deliver IT, training, and consulting solutions that achieve mission-critical outcomes.

Built on accountability, integrity, and quality, we go beyond expectations.With 70+ prime contracts and a proven record of client success, APV continues to grow andwerelooking for exceptional talent to grow with us.

At APV, we Always Provide Value POSITION SUMMARY Seeking a mission-driven Security Manager to support a large-scale federal healthcare technology program.

This role provides leadership across cybersecurity, compliance, risk management, continuous monitoring, incident response, and federal security governance.

DUTIES Lead security strategy, compliance, risk management, and continuous monitoring activities for complex federal information systems.Maintain ATO documentation, security artifacts, assessments, and authorization support packages.Oversee vulnerability management, POA&M development, remediation tracking, and security reporting.Coordinate security assessments, audits, penetration testing, and continuous monitoring activities.Ensure compliance with NIST RMF, NIST 800-53, FISMA, HIPAA, CMS security requirements, and federal cybersecurity standards.Support incident response, threat management, and security operations activities.Collaborate with architects, DevSecOps teams, developers, and government stakeholders to integrate security controls throughout the system lifecycle.Own the System Security Plan, security control assessments, and Authority to Operate (ATO) package, including support for reauthorization and for extending authorization to lower environments.Manage the POA&M lifecycle end to end: intake, risk rating, remediation planning, evidence, and closure within agency-defined timelines, with monthly reporting to government stakeholders.Apply NIST RMF, NIST SP 800-53, FISMA, HIPAA, and agency-specific control baselines such as CMS Acceptable Risk Safeguards (ARS) to a cloud-hosted AWS environment.Coordinate independent assessments, penetration testing, and continuous monitoring, and serve as the primary security interface to government security and privacy officials.Work shoulder to shoulder with the DevSecOps Lead so that scanning, patching, and control eviden...