System Security Officer (SSO)
Location: Columbia, MD (Hybrid/Remote – MON & WED in the office)
Residency Requirement: Candidates must have lived in the U.S. for at least 3 of the past 5 years and be authorized to work in the U.S. (Citizen, Permanent Resident, or EAD).
Sponsorship: This position does not offer any type of sponsorship. Candidates must already be authorized to work in the U.S. (e.g., Citizen, Permanent Resident, or EAD).
Clearance: Public Trust Clearance (or ability to obtain)
Job Overview:
Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). This role is responsible for proactively identifying and assessing security vulnerabilities, conducting application security testing, supporting risk mitigation activities, and ensuring systems maintain compliance with CMS, Department of Health and Human Services (HHS), and overarching government security requirements.
The SSO will collaborate closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement effective security improvements. The position may also support Information System Security Officer as a Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. Success in this role requires strong technical cybersecurity expertise, hands-on experience with security testing tools, familiarity with federal security frameworks, and the ability to proactively identify and address security risks in complex IT environments.
Responsibilities:
· Security Operations & Vulnerability Management
o Proactively monitor and review security vulnerabilities identified through automated security scanning tools and continuous monitoring activities.
o Analyze security findings to identify false positives, non-exploitable vulnerabilities, and legitimate security risks requiring remediation.
o Perform technical assessments of vulnerabilities to determine exploitability, severity, potential impact, and appropriate remediation strategies.
o Collaborate with development and operations teams to prioritize and resolve identified security vulnerabilities.
o Monitor remediation activities and validate corrective actions to ensure identified vulnerabilities have been appropriately addressed.
o Identify opportunities to strengthen system security configurations, vulnerability detection capabilities, and overall security posture.
· Application Security Testing & Security Engineering
o Perform in-depth Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved internal security tools.
o Analyze application security testing results, validate findings, and communicate actionable remediation recommendations to development teams.
o Work closely with software engineers to identify and mitigate application-level vulnerabilities throughout the software development lifecycle.
o Support secure development practices and the integration of security controls into development, testing, and deployment processes.
o Participate in security tooling pilots, evaluations, and improvement initiatives to enhance security automation, detection, and hardening capabilities.
o Recommend improvements to security configurations, development practices, and operational processes to reduce security risks.
· CMS Security Compliance & ISSO Support
o Support compliance with applicable CMS and HHS cybersecurity policies, standards, and requirements, including CMS Acceptable Risk Safeguards (ARS).
o Perform assigned Information System Security Officer (ISSO) responsibilities in accordance with HHS Information Security and Privacy Policy requirements, including Appendix A, Section 19.
o Support applicable Program ISSO (P-ISSO) and System ISSO (S-ISSO) responsibilities established under CMS security and privacy policies.
o Support ISSO-as-a-Service (ISSOaaS) requirements, including security oversight, risk identification, compliance monitoring, and documentation activities.
o Maintain and update security and compliance information within CMS' Governance, Risk, and Compliance platform, CFACTS.
o Support Security Control Assessor and Contingency Planning Coordination duties as defined in applicable HHS security policies.
o Complete CMS-required ISSO training, including CFACTS and the seven CMS ISSO training modules, within 60 days of starting the assigned ISSO role.
· Security Assessments, Risk Management & Compliance
o Support preparation for CMS security assessments.
o Review security controls, supporting documentation, and technical evidence to identify potential compliance gaps.
o Coordinate with technical teams to collect documentation and evidence required for security assessments, audits, and compliance reviews.
o Support the identification, documentation, prioritization, and remediation of security risks and compliance findings.
o Assist with security control assessments, contingency planning, and continuous monitoring activities.
o Maintain accurate security documentation and communicate compliance risks, deficiencies, and recommended corrective actions to relevant stakeholders.
· Team Coordination & Technical Leadership
o Collaborate closely with developers, business analysts, operations personnel, infrastructure teams, and government security stakeholders to maintain awareness of system activities and potential security impacts.
o Participate in technical discussions, planning sessions, and operational reviews to proactively identify security implications of proposed system changes.
o Serve as a technical lead for assigned security activities, providing guidance and recommendations to team members.
o Provide backup support to the Project Lead for Operational Security and Privacy Support Services, as assigned.
o Communicate security findings, risks, remediation priorities, and recommendations clearly to both technical and nontechnical stakeholders.
o Promote security awareness, continuous improvement, and proactive risk management across development and operations teams.