Highlights
TSCTI is seeking an experienced Healthcare Cybersecurity Compliance Subject Matter Expert (SME) to support federal, state, and healthcare cybersecurity engagements involving security assessments, compliance reviews, risk assessments, and advisory services. We are looking for a seasoned healthcare cybersecurity professional who can bridge technical cybersecurity expertise with healthcare regulatory compliance, providing both strategic guidance and hands-on assessment support for healthcare and public sector clients.
Numbers & Facts
| Location | McClean, VA (Remote) |
| Industry | Computer/IT Services |
| Company Size | 100 to 499 employees |
| Year Founded | 1997 |
| Website | https://www.tscti.com/careers-0 |
Description
22nd Century Technologies, Inc.
Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)
Last Updated: 07/22/2026
Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)
Location: Remote (U.S.) with occasional travel (up to 20%) Employment Type: Contract / 1099 (Part-Time, On-Demand) Experience: 10+ Years
TSCTI is seeking an experienced Healthcare Cybersecurity Compliance Subject Matter Expert (SME) to support federal, state, and healthcare cybersecurity engagements involving security assessments, compliance reviews, risk assessments, and advisory services.
The ideal candidate possesses extensive knowledge of HIPAA, HITECH, CMS security requirements, NIST cybersecurity frameworks, and healthcare information security practices. The SME will provide technical leadership during cybersecurity assessments, validate compliance with applicable regulations, review security documentation, and support proposal development for healthcare-focused initiatives.
Key Responsibilities
1.
Lead and support cybersecurity risk assessments for healthcare organizations.
2.
Evaluate compliance with:
o
HIPAA Security Rule
o
HIPAA Privacy Rule
o
HITECH Act
o
CMS Information Security Requirements
o
Healthcare cybersecurity best practices
3.
Perform security and privacy control reviews against:
o
NIST SP 800-53
o
NIST Cybersecurity Framework (CSF)
o
NIST RMF (SP 800-37)
o
NIST SP 800-30 Risk Assessment
4.
Assess administrative, technical, and physical safeguards protecting ePHI.
5.
Review security policies, procedures, standards, and governance documentation.
6.
Conduct gap assessments and develop remediation recommendations.
7.
Participate in customer interviews, workshops, and technical discussions.
8.
Support proposal development by reviewing Statements of Work (SOWs), technical responses, staffing plans, and cost estimates.
9.
Collaborate with technical assessors, penetration testers, and project managers throughout assessment activities.
10.
Develop executive-level findings, risk summaries, and compliance reports.
11.
Provide guidance on healthcare security governance, privacy, and regulatory requirements.
Required Qualifications
1.
Bachelor's degree in Cybersecurity, Information Security, Computer Science, Healthcare Information Management, or related field.
2.
10+ years of cybersecurity and compliance experience.
3.
5+ years supporting healthcare organizations or healthcare regulatory compliance.
4.
Strong knowledge of:
o
HIPAA
o
HITECH
Cyber Security Services & Solutions www.tscti.com
www.cyber.tscti.com
22nd Century Technologies, Inc.
o
ePHI protection
o
CMS security requirements
o
Healthcare privacy regulations
5.
Experience conducting cybersecurity risk assessments.
6.
Experience with NIST 800-53 control assessments.
7.
Strong report writing and executive presentation skills.
8.
Ability to communicate effectively with executive leadership and technical teams.
Preferred Qualifications
Experience supporting one or more of the following:
1.
State Medicaid Agencies
2.
CMS Programs
3.
Medicaid Enterprise Systems (MES)
4.
Rural Healthcare Organizations
5.
Hospitals and Health Systems
6.
Health Information Exchanges (HIE)
7.
Federally Qualified Health Centers (FQHC)
8.
Public Health Agencies
Nice-to-Have Experience
1.
CMS MARS-E
2.
Medicaid Enterprise Systems
3.
HITRUST CSF
4.
FedRAMP
5.
SOC 2
6.
ISO 27001
7.
Third-party risk assessments
8.
Technical writing for compliance documentation
Ideal Candidate Profile
We are looking for a seasoned healthcare cybersecurity professional who can bridge technical cybersecurity expertise with healthcare regulatory compliance, providing both strategic guidance and hands-on assessment support for healthcare and public sector clients. Experience supporting HIPAA/HITECH, CMS, NIST-based assessments, and state or federal healthcare programs is highly desirabl
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.
Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)
Last Updated: 07/22/2026
Healthcare Cybersecurity Compliance SME (HIPAA / HITECH / NIST)
Location: Remote (U.S.) with occasional travel (up to 20%) Employment Type: Contract / 1099 (Part-Time, On-Demand) Experience: 10+ Years
TSCTI is seeking an experienced Healthcare Cybersecurity Compliance Subject Matter Expert (SME) to support federal, state, and healthcare cybersecurity engagements involving security assessments, compliance reviews, risk assessments, and advisory services.
The ideal candidate possesses extensive knowledge of HIPAA, HITECH, CMS security requirements, NIST cybersecurity frameworks, and healthcare information security practices. The SME will provide technical leadership during cybersecurity assessments, validate compliance with applicable regulations, review security documentation, and support proposal development for healthcare-focused initiatives.
Key Responsibilities
1.
Lead and support cybersecurity risk assessments for healthcare organizations.
2.
Evaluate compliance with:
o
HIPAA Security Rule
o
HIPAA Privacy Rule
o
HITECH Act
o
CMS Information Security Requirements
o
Healthcare cybersecurity best practices
3.
Perform security and privacy control reviews against:
o
NIST SP 800-53
o
NIST Cybersecurity Framework (CSF)
o
NIST RMF (SP 800-37)
o
NIST SP 800-30 Risk Assessment
4.
Assess administrative, technical, and physical safeguards protecting ePHI.
5.
Review security policies, procedures, standards, and governance documentation.
6.
Conduct gap assessments and develop remediation recommendations.
7.
Participate in customer interviews, workshops, and technical discussions.
8.
Support proposal development by reviewing Statements of Work (SOWs), technical responses, staffing plans, and cost estimates.
9.
Collaborate with technical assessors, penetration testers, and project managers throughout assessment activities.
10.
Develop executive-level findings, risk summaries, and compliance reports.
11.
Provide guidance on healthcare security governance, privacy, and regulatory requirements.
Required Qualifications
1.
Bachelor's degree in Cybersecurity, Information Security, Computer Science, Healthcare Information Management, or related field.
2.
10+ years of cybersecurity and compliance experience.
3.
5+ years supporting healthcare organizations or healthcare regulatory compliance.
4.
Strong knowledge of:
o
HIPAA
o
HITECH
Cyber Security Services & Solutions www.tscti.com
www.cyber.tscti.com
22nd Century Technologies, Inc.
o
ePHI protection
o
CMS security requirements
o
Healthcare privacy regulations
5.
Experience conducting cybersecurity risk assessments.
6.
Experience with NIST 800-53 control assessments.
7.
Strong report writing and executive presentation skills.
8.
Ability to communicate effectively with executive leadership and technical teams.
Preferred Qualifications
Experience supporting one or more of the following:
1.
State Medicaid Agencies
2.
CMS Programs
3.
Medicaid Enterprise Systems (MES)
4.
Rural Healthcare Organizations
5.
Hospitals and Health Systems
6.
Health Information Exchanges (HIE)
7.
Federally Qualified Health Centers (FQHC)
8.
Public Health Agencies
Nice-to-Have Experience
1.
CMS MARS-E
2.
Medicaid Enterprise Systems
3.
HITRUST CSF
4.
FedRAMP
5.
SOC 2
6.
ISO 27001
7.
Third-party risk assessments
8.
Technical writing for compliance documentation
Ideal Candidate Profile
We are looking for a seasoned healthcare cybersecurity professional who can bridge technical cybersecurity expertise with healthcare regulatory compliance, providing both strategic guidance and hands-on assessment support for healthcare and public sector clients. Experience supporting HIPAA/HITECH, CMS, NIST-based assessments, and state or federal healthcare programs is highly desirabl
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.
About Company
22nd Century Technologies, Inc., is one of the fastest growing IT Service Integrator and Workforce Solution companies in the United States. Founded in 1997, 22nd Century Technologies is a Certified National Minority Business Enterprise with 6,000+ people including 600+ Cyber SMEs nationwide supporting our customers in all 50 states, Canada, and Mexico. With HQs in Somerset, NJ and Mclean, VA, 22nd Century has 14 offices throughout the United States. As part of our unrelenting focus on quality and compliance, 22nd Century Technologies’ delivery is based on Certified Matured Processes including CMMI L3 Dev & SVC, ISO 20000, ISO 27001, and ISO 9001 quality processes. With a strong focus on the public sector, 22nd Century currently holds government contracts with 14 out of 15 Federal Executive agencies including DoD, 37 other Federal agencies, 50 States, 115+ Local agencies, and 37 School Districts. In the last three years, we have expanded our services to Fortune 500 and other commercial clients and currently support 80+ commercial clients.
Recognized among “Best Company to Work For” by Forbes, 22nd Century Technologies, Inc., consistently exceeds our clients’ expectations by focusing on their absolute satisfaction with jobs while keeping our employees motivated.
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.