Work Location and On-Site/Telework Requirements: Hybrid - NIH, Bethesda, MD. On site for governance-body sessions and workshops as scheduled.
Citizenship: U.S. Citizenship required
Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.
Salary Range: $145,000-$155,000 yearly salary
Overview:
You will lead Task 7, Integration of ZTA into NIH Architectural Governance, under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). You will work in the Risk & Policy Pod and support Subtask 2.4 and Task 1. You will build Zero Trust checks into the governance bodies NIH already has, rather than creating parallel ones.
Responsibilities:
- In the first 45 days, map NIH's governance touchpoints: who decides, what artifact they review, and when. Touchpoints include NIH Manual Chapter 2808 (EA Policy), domain teams and the NIHRFC standards process, the Architecture Review Board, the IT Management Committee, CPIC and CIF investment reviews, acquisition reviews, and A&A.
- By day 90, deliver governance recommendations: ZTA decision rights for each body, OITA's role as ZTA design authority, a time-limited exception and waiver path, and the escalation route to the CIO.
- By day 90, deliver ZTA criteria and checkpoints: short question sets and required evidence that a reviewer can apply in about 15 minutes. Cover CPIC/CIF, ARB, acquisition, A&A/ATO, O&M project justification, and change management.
- Align the ZTA reference architectures to NIH EA domains (Subtask 2.4) using the HHS Federated EA Framework layers: Strategy, Business, Investment, Data, Service, Technology, and Workforce.
- Feed checkpoints into the Process Integration Tracker (Subtask 2.3). Run quarterly governance assessments covering checkpoint compliance, exception aging, and recurring findings.
Tools & Technology Environment: EA repository tools (e.g., Sparx EA, Avolution ABACUS, LeanIX), Confluence and the OCIO ZTA Wiki, Power BI.
Required Qualifications:
- Bachelor's degree plus 10+ years of enterprise architecture experience.
- Working knowledge of FEAF and/or the HHS Federated EA Framework.
- Experience with architecture review boards and the CPIC process.
- Ability to obtain an NIH suitability determination and PIV credential; fluent in English.
Preferred Qualifications:
- TOGAF or FEAC certification.
- HHS or NIH EA experience, including NIH Manual Chapter 2808 and NIHRFC.
- Background in security architecture or Zero Trust.
- Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.
