System Security Officer (SSO)

Cogent People Inc•Columbia, MD

7d•Hybrid

About The Position

Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). The role proactively identifies and assesses security vulnerabilities, conducts application security testing, supports risk mitigation, and helps systems maintain compliance with CMS, Department of Health and Human Services (HHS), and broader government security requirements. The SSO works closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement security improvements. The role may also support Information System Security Officer as a Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. It requires technical cybersecurity expertise, hands-on experience with security testing tools, familiarity with federal security frameworks, and the ability to identify and address security risks in complex IT environments. The position is based in Columbia, Maryland, with a hybrid/remote arrangement requiring in-office work on Mondays and Wednesdays. Candidates must have lived in the U.S. for at least 3 of the past 5 years and must already be authorized to work in the U.S.; sponsorship is not offered. Public Trust clearance or the ability to obtain it is required.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field, or equivalent professional experience.
Professional experience in information systems security, cybersecurity engineering, application security, or a related technical security role.
Hands-on experience performing vulnerability assessments, analyzing security scanning results, and validating false positives and non-exploitable findings.
Experience conducting Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
Strong understanding of application security vulnerabilities, remediation strategies, and secure software development practices.
Experience with security testing, vulnerability management, and continuous monitoring tools.
Familiarity with federal cybersecurity requirements, security controls, and compliance frameworks, including NIST Risk Management Framework (RMF) and NIST SP 800-53.
Ability to evaluate technical security findings and translate them into actionable recommendations for development and operations teams.
Experience supporting security assessments, compliance reviews, risk management activities, and security documentation.
Ability to collaborate effectively with software development, infrastructure, operations, and cybersecurity teams.
Strong attention to detail and commitment to accurate, high-quality work.
Ability to manage time and prioritize tasks in a fast-paced environment.
Problem-solving skills and a proactive, solution-oriented mindset.
Must have lived in the U.S. for at least 3 of the past 5 years and already be authorized to work in the U.S.; sponsorship is not offered.
Public Trust clearance or ability to obtain it.

Nice To Haves

Direct experience supporting CMS information systems, cybersecurity operations, or security compliance activities.
Experience serving as an SSO or ISSO within CMS, HHS, or another federal agency.
Working knowledge of CMS Acceptable Risk Safeguards (ARS) and applicable CMS security and privacy policies.
Hands-on experience with CFACTS, CMS’ Governance, Risk, and Compliance platform.
Experience preparing for or supporting CMS Security Risk Assessment Program (CSRAP) assessments.
Familiarity with HHS Information Security and Privacy Policy requirements, including P-ISSO and S-ISSO responsibilities.
Experience supporting Authorization to Operate (ATO) activities, security control assessments, Plans of Action and Milestones (POA&Ms), and continuous monitoring.
Experience with federal contingency planning and security assessment coordination.
Experience with DevSecOps practices, CI/CD pipelines, automated security testing, and security integration in Agile software development environments.
Familiarity with application security testing tools such as Fortify, Checkmarx, SonarQube, Burp Suite, OWASP ZAP, or similar tools.
Experience participating in security hardening initiatives, security automation efforts, or cybersecurity tool evaluations.
Relevant cybersecurity certifications such as CISSP, CISM, CompTIA Security+, Certified Authorization Professional (CAP/CGRC), or equivalent.
Experience providing technical leadership, mentoring security personnel, or coordinating security activities across multidisciplinary teams.

Responsibilities

Monitor and review vulnerabilities identified through automated security scanning tools and continuous monitoring.
Analyze security findings to distinguish false positives and non-exploitable findings from risks requiring remediation.
Assess vulnerabilities for exploitability, severity, potential impact, and appropriate remediation strategies.
Collaborate with development and operations teams to prioritize and resolve vulnerabilities; monitor remediation and validate corrective actions.
Identify ways to strengthen security configurations, vulnerability detection, and overall security posture.
Perform Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved internal tools; analyze results and provide actionable remediation recommendations.
Work with software engineers to mitigate application vulnerabilities throughout the software development lifecycle and support secure development practices and security-control integration.
Participate in security-tool pilots, evaluations, and improvement initiatives, and recommend improvements to configurations, development practices, and operational processes.
Support compliance with CMS and HHS cybersecurity policies, standards, and requirements, including CMS Acceptable Risk Safeguards (ARS).
Perform assigned ISSO responsibilities under HHS Information Security and Privacy Policy requirements, including Appendix A, Section 19, and support applicable P-ISSO and S-ISSO responsibilities.
Support ISSOaaS security oversight, risk identification, compliance monitoring, and documentation activities.
Maintain and update security and compliance information in CMS’ CFACTS Governance, Risk, and Compliance platform.
Support Security Control Assessor and Contingency Planning Coordination duties and complete required CMS ISSO training, including CFACTS and seven CMS ISSO training modules, within 60 days of starting the assigned ISSO role.
Support preparation for CMS security assessments; review security controls, documentation, and technical evidence to identify compliance gaps.
Coordinate collection of documentation and evidence for assessments, audits, and compliance reviews; support risk identification, documentation, prioritization, and remediation.
Assist with security control assessments, contingency planning, and continuous monitoring; maintain accurate security documentation and communicate risks, deficiencies, and corrective actions.
Collaborate with developers, business analysts, operations and infrastructure personnel, and government security stakeholders to identify security implications of system activities and changes.
Participate in technical discussions, planning sessions, and operational reviews; serve as technical lead for assigned security activities and guide team members.
Provide backup support to the Project Lead for Operational Security and Privacy Support Services, as assigned.
Communicate security findings, risks, remediation priorities, and recommendations to technical and nontechnical stakeholders; promote security awareness, continuous improvement, and proactive risk management.