Software Development, Lead Associate

Peraton; Vicenza; In loco; EUR 95.000 - 138.000; Tempo pieno

Descrizione del lavoro

Peraton seeks a Mid‑level DevSecOps Engineer to strengthen security, reliability, and compliance of mission‑critical CMS systems. You will shepherd security through the development lifecycle, maintain adherence to federal cybersecurity standards, and ensure operational readiness of modernized CMS systems at CMS.

You will collaborate across DevOps, engineering, and security teams to implement CI/CD security controls, cloud security, and vulnerability management in a federal environment.

Competenze

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or related field; additional experience may be substituted in lieu of degree.
• 5 to 7 years of experience in cybersecurity, DevSecOps, or system engineering roles supporting federal programs.
• Experience acting as an ISSO or security engineer for a FISMA Moderate or FedRAMP Moderate system.
• Hands‑on experience preparing security authorization documentation such as SSPs, SARs, POA&Ms, and Continuous Monitoring updates.
• Strong understanding of NIST 800‑53 security controls, RMF, CMS ARS 5.1, and continuous monitoring requirements.
• Practical experience supporting or integrating security processes in DevSecOps pipelines, CI/CD workflows, or automated deployment environments.
• Experience with vulnerability management tools and processes, including scanning, analysis, and remediation tracking.
• Ability to support audits and communicate effectively with assessment teams, program stakeholders, and government security representatives.
• U.S. citizenship and the ability to obtain and maintain a public trust or equivalent clearance.

Mansioni

• Serve as the Information System Security Officer (ISSO) for the ClaimsCore Program, ensuring full compliance with FISMA Moderate, FedRAMP Moderate, and CMS ARS 5.1 security requirements.
• Prepare, maintain, and update all Certification and Accreditation (C&A) and Security Assessment and Authorization (SA&A) documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Contingency Plans, and Plan of Action and Milestones (POA&Ms).
• Conduct and document ongoing risk assessments, vulnerability assessments, and security control evaluations across the program’s cloud and on‑premises environments.
• Manage and coordinate the Authority to Operate (ATO) lifecycle, including initial authorization, continuous monitoring, control implementation reviews, and audit preparation.
• Ensure zero open Critical or High vulnerabilities at system go‑live and maintain compliance with vulnerability remediation SLAs.
• Respond to and manage security incident notifications within required timelines (1 hour for initial reporting). Coordinate with internal security teams and external stakeholders to support incident response processes.
• Support internal and external audits, including CSRAP, CFO, OMB A‑123, and annual security assessments.
• Collaborate with DevOps, engineering, and operations teams to integrate security best practices into CI/CD pipelines, infrastructure‑as‑code, and deployment processes.
• Monitor and enhance security posture using tools such as vulnerability scanners, SIEM platforms, configuration management tools, and compliance automation platforms.
• Contribute to continuous improvement of security procedures, engineering practices, and system hardening baselines.
• Assist in the implementation and maintenance of cloud security configurations aligned with agency and program requirements.
• Provide security guidance during architecture reviews, design sessions, sprint planning, and change control processes.
• Ensure security documentation, diagrams, inventories, and boundary definitions are accurate and up to date.

Conoscenze

DevSecOps

CI/CD

Vulnerability management

Security governance

Cloud security

Formazione

Bachelor’s degree in CS or related field

Strumenti

GitLab/GitHub CI/CD

Jenkins

Terraform

Ansible

Tenable

Splunk

Descrizione del lavoro

Qualifications (Required):

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or related field; additional experience may be substituted in lieu of degree.
• 5 to 7 years of experience in cybersecurity, DevSecOps, or system engineering roles supporting federal programs.
• Experience acting as an ISSO or security engineer for a FISMA Moderate or FedRAMP Moderate system.
• Hands‑on experience preparing security authorization documentation such as SSPs, SARs, POA&Ms, and Continuous Monitoring updates.
• Strong understanding of NIST 800‑53 security controls, Risk Management Framework (RMF), CMS ARS 5.1, and continuous monitoring requirements.
• Practical experience supporting or integrating security processes in DevSecOps pipelines, CI/CD workflows, or automated deployment environments.
• Experience with vulnerability management tools and processes, including scanning, analysis, and remediation tracking.
• Ability to support audits and communicate effectively with assessment teams, program stakeholders, and government security representatives.
• U.S. citizenship and the ability to obtain and maintain a public trust or equivalent clearance.

Qualifications (Preferred):

• Experience supporting CMS programs or other HHS components.
• Familiarity with FedRAMP documentation, cloud boundary definitions, and cloud‑native security practices.
• Experience with AWS or Azure security services, cloud configuration baselines, and cloud compliance frameworks.
• Working knowledge of tools commonly used within Peraton and similar enterprises, such as GitLab/GitHub CI/CD, Jenkins, Terraform, Ansible, Tenable, Splunk, or similar platforms.
• Security certifications such as Security+, CISSP, CISM, CCSP, or AWS/Azure security certifications.
• Experience integrating legacy systems into modern cloud or hybrid architectures with secure migration practices.
• Knowledge of container security (Docker, Kubernetes) and infrastructure‑as‑code security scanning.

Peraton is seeking a Mid‑level DevSecOps Engineer to join our team of qualified, diverse professionals. In this role, you will support the security, reliability, and compliance of mission‑critical systems within the DME Program. The ideal candidate will play a key part in integrating security throughout the development lifecycle, maintaining adherence to federal cybersecurity standards, and ensuring the operational readiness of modernized systems at the Centers for Medicare & Medicaid Services (CMS). This position supports a highly visible environment where strong technical execution, security rigor, and cross‑team collaboration are essential.

Responsibilities:

• Serve as the Information System Security Officer (ISSO) for the ClaimsCore Program, ensuring full compliance with FISMA Moderate, FedRAMP Moderate, and CMS ARS 5.1 security requirements.
• Prepare, maintain, and update all Certification and Accreditation (C&A) and Security Assessment and Authorization (SA&A) documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Contingency Plans, and Plan of Action and Milestones (POA&Ms).
• Conduct and document ongoing risk assessments, vulnerability assessments, and security control evaluations across the program’s cloud and on‑premises environments.
• Manage and coordinate the Authority to Operate (ATO) lifecycle, including initial authorization, continuous monitoring, control implementation reviews, and audit preparation.
• Ensure zero open Critical or High vulnerabilities at system go‑live and maintain compliance with vulnerability remediation SLAs.
• Respond to and manage security incident notifications within required timelines (1 hour for initial reporting). Coordinate with internal security teams and external stakeholders to support incident response processes.
• Support internal and external audits, including CSRAP, CFO, OMB A‑123, and annual security assessments.
• Collaborate with DevOps, engineering, and operations teams to integrate security best practices into CI/CD pipelines, infrastructure‑as‑code, and deployment processes.
• Monitor and enhance security posture using tools such as vulnerability scanners, SIEM platforms, configuration management tools, and compliance automation platforms.
• Contribute to continuous improvement of security procedures, engineering practices, and system hardening baselines.
• Assist in the implementation and maintenance of cloud security configurations aligned with agency and program requirements.
• Provide security guidance during architecture reviews, design sessions, sprint planning, and change control processes.
• Ensure security documentation, diagrams, inventories, and boundary definitions are accurate and up to date.