System Security Officer (SSO)

Openings & Internships•Columbia, MD

6d•Hybrid

About The Position

Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). The SSO identifies and assesses security vulnerabilities, conducts application security testing, supports risk mitigation, and helps ensure systems comply with CMS, HHS, and government security requirements. The role works closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement security improvements. It may also support ISSO-as-a-Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. The position is based in Columbia, Maryland, with a hybrid/remote arrangement requiring office attendance on Monday and Wednesday. Candidates must have lived in the United States for at least three of the past five years and already be authorized to work in the United States; sponsorship is not offered. A Public Trust clearance, or the ability to obtain one, is required.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field, or equivalent professional experience.
Professional experience in information systems security, cybersecurity engineering, application security, or a related technical security role.
Hands-on experience performing vulnerability assessments, analyzing security scan results, and validating false positives and non-exploitable findings.
Experience conducting Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
Strong understanding of application security vulnerabilities, remediation strategies, and secure software development practices.
Experience with security testing, vulnerability management, and continuous monitoring tools.
Familiarity with federal cybersecurity requirements, security controls, and compliance frameworks, including NIST Risk Management Framework (RMF) and NIST SP 800-53.
Ability to evaluate technical security findings and translate them into actionable recommendations for development and operations teams.
Experience supporting security assessments, compliance reviews, risk management activities, and security documentation.
Ability to collaborate effectively with software development, infrastructure, operations, and cybersecurity teams.
Strong attention to detail and commitment to accurate, high-quality work.
Ability to manage time and prioritize tasks in a fast-paced environment.
Problem-solving skills and a proactive, solution-oriented mindset.
Must have lived in the United States for at least three of the past five years and be authorized to work in the United States; sponsorship is not offered.
Must have or be able to obtain a Public Trust clearance.

Nice To Haves

Direct experience supporting CMS information systems, cybersecurity operations, or security compliance activities.
Experience serving as an SSO or ISSO within CMS, HHS, or another federal agency.
Working knowledge of CMS Acceptable Risk Safeguards (ARS) and applicable CMS security and privacy policies.
Hands-on experience with CFACTS, CMS' Governance, Risk, and Compliance platform.
Experience preparing for or supporting CMS Security Risk Assessment Program (CSRAP) assessments.
Familiarity with HHS Information Security and Privacy Policy requirements, including P-ISSO and S-ISSO responsibilities.
Experience supporting Authorization to Operate (ATO) activities, security control assessments, Plans of Action and Milestones (POA&Ms), and continuous monitoring.
Experience with federal contingency planning and security assessment coordination.
Experience with DevSecOps practices, CI/CD pipelines, automated security testing, and security integration in Agile software development environments.
Familiarity with application security testing tools such as Fortify, Checkmarx, SonarQube, Burp Suite, OWASP ZAP, or similar tools.
Experience participating in security hardening, security automation, or cybersecurity tool evaluations.
Relevant cybersecurity certifications such as CISSP, CISM, CompTIA Security+, Certified Authorization Professional (CAP/CGRC), or equivalent.
Experience providing technical leadership, mentoring security personnel, or coordinating security activities across multidisciplinary teams.

Responsibilities

Proactively monitor and review vulnerabilities identified by automated security scanning tools and continuous monitoring activities.
Analyze security findings to identify false positives, non-exploitable vulnerabilities, and legitimate risks requiring remediation.
Assess vulnerabilities for exploitability, severity, potential impact, and appropriate remediation strategies.
Work with development and operations teams to prioritize and resolve vulnerabilities, monitor remediation, and validate corrective actions.
Identify ways to improve system security configurations, vulnerability detection, and overall security posture.
Perform Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), analyze results, validate findings, and provide actionable recommendations to development teams.
Work with software engineers to mitigate application vulnerabilities throughout the software development lifecycle and support integration of security controls into development, testing, and deployment.
Participate in security tooling pilots, evaluations, and improvement initiatives; recommend improvements to configurations, development practices, and operational processes.
Support compliance with CMS and HHS cybersecurity policies and requirements, including CMS Acceptable Risk Safeguards (ARS).
Perform assigned ISSO responsibilities in accordance with HHS Information Security and Privacy Policy requirements, including Appendix A, Section 19, and support applicable P-ISSO and S-ISSO responsibilities.
Support ISSOaaS security oversight, risk identification, compliance monitoring, and documentation activities.
Maintain and update security and compliance information in CMS' Governance, Risk, and Compliance platform, CFACTS.
Support Security Control Assessor and Contingency Planning Coordination duties, security assessments, control reviews, evidence collection, audits, compliance reviews, risk management, and continuous monitoring.
Complete CMS-required ISSO training, including CFACTS and the seven CMS ISSO training modules, within 60 days of starting the assigned ISSO role.
Maintain accurate security documentation and communicate compliance risks, deficiencies, and corrective actions to stakeholders.
Collaborate with developers, business analysts, operations and infrastructure teams, and government security stakeholders to identify security implications of system activities and proposed changes.
Serve as technical lead for assigned security activities and provide guidance and recommendations to team members.
Provide backup support to the Project Lead for Operational Security and Privacy Support Services, as assigned.
Communicate security findings, risks, remediation priorities, and recommendations to technical and nontechnical stakeholders; promote security awareness and continuous improvement.