Healthcare Cybersecurity Compliance SME

22nd Century Technologies, Inc.

Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)

Last Updated

07/22/2026

Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)

Location

Remote (U.S.) with occasional travel (up to 20%) Employment Type: Contract / 1099 (Part-Time, On-Demand) Experience: 10+ Years

TSCTI is seeking an experienced Healthcare Cybersecurity Compliance Subject Matter Expert (SME) to support federal, state, and healthcare cybersecurity engagements involving security assessments, compliance reviews, risk assessments, and advisory services.

The ideal candidate possesses extensive knowledge of HIPAA, HITECH, CMS security requirements, NIST cybersecurity frameworks, and healthcare information security practices. The SME will provide technical leadership during cybersecurity assessments, validate compliance with applicable regulations, review security documentation, and support proposal development for healthcare-focused initiatives.

Key Responsibilities

1.

Lead and support cybersecurity risk assessments for healthcare organizations.

2.

Evaluate compliance with

o

HIPAA Security Rule

o

HIPAA Privacy Rule

o

HITECH Act

o

CMS Information Security Requirements

o

Healthcare cybersecurity best practices

3.

Perform security and privacy control reviews against

o

NIST SP 800-53

o

NIST Cybersecurity Framework (CSF)

o

NIST RMF (SP 800-37)

o

NIST SP 800-30 Risk Assessment

4.

Assess administrative, technical, and physical safeguards protecting ePHI.

5.

Review security policies, procedures, standards, and governance documentation.

6.

Conduct gap assessments and develop remediation recommendations.

7.

Participate in customer interviews, workshops, and technical discussions.

8.

Support proposal development by reviewing Statements of Work (SOWs), technical responses, staffing plans, and cost estimates.

9.

Collaborate with technical assessors, penetration testers, and project managers throughout assessment activities.

10.

Develop executive-level findings, risk summaries, and compliance reports.

11.

Provide guidance on healthcare security governance, privacy, and regulatory requirements.

Required Qualifications

1.

Bachelor's degree in Cybersecurity, Information Security, Computer Science, Healthcare Information Management, or related field.

2.

10+ years of cybersecurity and compliance experience.

3.

5+ years supporting healthcare organizations or healthcare regulatory compliance.

4.

Strong knowledge of

o

HIPAA

o

HITECH

Cyber Security Services & Solutions www.tscti.com

www.cyber.tscti.com

22nd Century Technologies, Inc.

o

ePHI protection

o

CMS security requirements

o

Healthcare privacy regulations

5.

Experience conducting cybersecurity risk assessments.

6.

Experience with NIST 800-53 control assessments.

7.

Strong report writing and executive presentation skills.

8.

Ability to communicate effectively with executive leadership and technical teams.

Preferred Qualifications

Experience supporting one or more of the following

1.

State Medicaid Agencies

2.

CMS Programs

3.

Medicaid Enterprise Systems (MES)

4.

Rural Healthcare Organizations

5.

Hospitals and Health Systems

6.

Health Information Exchanges (HIE)

7.

Federally Qualified Health Centers (FQHC)

8.

Public Health Agencies

Nice-to-Have Experience

1.

CMS MARS-E

2.

Medicaid Enterprise Systems

3.

HITRUST CSF

4.

FedRAMP

5.

SOC 2

6.

ISO 27001

7.

Third-party risk assessments

8.

Technical writing for compliance documentation

Ideal Candidate Profile

We are looking for a seasoned healthcare cybersecurity professional who can bridge technical cybersecurity expertise with healthcare regulatory compliance, providing both strategic guidance and hands-on assessment support for healthcare and public sector clients. Experience supporting HIPAA/HITECH, CMS, NIST-based assessments, and state or federal healthcare programs is highly desirabl

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.