Information Security Officer

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as a senior security advisor to CMS ISSOs, product owners, engineers, infrastructure teams, and program leadership.

• Analyze FISMA, NIST RMF, NIST SP 800-53, CMS ARS, and agency security requirements, converting them into technical and operational actions.

• Create, assess, and maintain comprehensive security control implementation statements along with supporting evidence.

• Manage ATO artifacts, including System Security Plans, Security Impact Analyses, POA&Ms, risk assessments, contingency plans, incident response plans, and configuration management plans.

• Lead Security Impact Analyses for system, application, infrastructure, cloud, data, and configuration modifications.

• Assist with security assessments and audits by facilitating evidence collection, reviewing artifacts, addressing assessor questions, documenting gaps, and monitoring corrective actions.

• Evaluate vulnerability and compliance scan results, confirm findings, assess risk, and oversee remediation efforts.

• Develop and review vulnerability documentation, remediation plans, POA&Ms, false-positive determinations, and risk exception requests.

• Monitor vulnerability and compliance findings through assignment, remediation, mitigation, risk acceptance, retesting, and resolution.

• Facilitate continuous monitoring, access reviews, security data calls, compliance reporting, and assessments of security posture.

• Identify gaps in controls, evidence, and documentation, recommending corrective actions or process enhancements.

• Create security metrics, dashboards, status reports, and risk summaries for government stakeholders and program leadership.

• Communicate security risks, decisions, dependencies, overdue actions, and remediation status effectively.

• Mentor security team members and conduct quality reviews of security deliverables.

⛳️ Requirements

• A minimum of 8+ years of progressive experience in information security, cybersecurity engineering, or system security roles.

• Bachelor's degree in computer science, Information Systems, Engineering, Business, or another related scientific or technical field.

• Experience supporting federal systems governed by FISMA and the NIST Risk Management Framework.

• Familiarity with applying NIST SP 800-53 security and privacy controls, as well as CMS ARS or comparable federal security requirements.

• Experience in developing, reviewing, and maintaining system-specific security control implementation statements and supporting evidence.

• Proficient in supporting ATO activities and managing System Security Plans, Security Impact Analyses, POA&Ms, risk assessments, contingency plans, incident response plans, configuration management plans, and associated security artifacts.

• Experience in security assessments and audits, including evidence collection, responding to assessors, gap identification, corrective action planning, remediation tracking, and closure validation.

• Proven experience managing vulnerability and compliance findings through validation, assignment, remediation, mitigation, risk acceptance, retesting, and closure.

• Knowledge of vulnerability and compliance tools such as Tenable, Snyk, AWS Security Hub, AWS Inspector, or similar platforms.

• Ability to prepare technically supported risk exception requests and vulnerability documentation.

• Skilled in creating accurate, audit-ready documentation and communicating security requirements, risks, findings, and remediation efforts to both technical and non-technical stakeholders.

• Capable of managing multiple assignments, meeting deadlines, maintaining precise status reporting, and escalating risks or blockers as necessary.

• Must be able to obtain and maintain a Public Trust clearance.

• Candidates must have resided in the United States for at least 3 of the last 5 years.

• Direct experience with CMS systems, CMS security programs, or CMS ATO is preferred.

• Advanced experience with CMS ARS 5.0 or later is desired.

• Experience with AWS cloud security is preferred.

• Familiarity with DevSecOps, CI/CD pipelines, source-code scanning, software composition analysis, container scanning, and security release reviews is advantageous.

• Experience using Jira, Confluence, and ServiceNow is preferred.

• Current certifications such as CISSP, CISM, CISA, CRISC, CAP/CGRC, CCSP, or equivalent security or audit certification are desirable.

🏝️ Benefits

• Medical coverage

• Dental coverage

• Vision coverage

• 401(k) retirement benefits

• Paid time off

• Paid holidays

• Life insurance

• Disability insurance

• Wellness and employee support programs

• Remote work environment

• Occasional travel for training and project meetings, estimated at less than 5% per year