Cybersecurity Engineer - Health IT

Cormac Corporation; Leesburg (VA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible work options

Job summary

Cormac Corporation in Leesburg, VA, seeks a Cybersecurity Engineer to safeguard CMS Reporting and Quality systems in AWS Cloud. You will guide teams on security policy, risk and compliance, and work hands-on with DevOps to remediate findings.

This role emphasizes governance, vulnerability management, and data protection for PII/PHI in a federal healthcare context. Responsibilities include securing IAM, KMS, and logging, defending ATO artifacts, and communicating security risks to leadership and

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or related field.
• U.S. Citizenship and ability to obtain Public Trust (Tier I) clearance.
• 8+ years of progressive information security or cybersecurity experience.
• Experience owning and defending an Authorization to Operate (ATO) and related artifacts.
• Hands-on vulnerability and compliance scanning with AWS Inspector and AWS Security Hub.
• Strong ability to secure AWS cloud environments (IAM, KMS, Security Groups, CloudWatch).

Responsibilities

• Guide Product Owners, ISSOs, engineering and infra staff on security policies and procedures.
• Analyze CMS security requirements (FISMA, FedRAMP, HIPAA, NIST) for non-security teams.
• Develop and defend System Security Plans, incident response and contingency plans.
• Conduct vulnerability and compliance assessments; determine remediation priorities.
• Drive closure of security findings with developers, DevOps and infra engineers.
• Secure AWS environment with IAM least-privilege, KMS, CloudWatch monitoring and logging.
• Review identity integration (HARP/IDM) including authentication and access lifecycle.
• Respond to alerts, investigate incidents, and maintain security dashboards.
• Present vulnerability/compliance reviews to Government stakeholders and plan activity.
• Secure Databricks environments and protect PII/PHI data.
• Track findings in ServiceNow and monitor logs in CloudWatch and New Relic.
• Assess AI/LLM security implications and educate teams on secure development.

Skills

Regulatory compliance

Security governance

Cloud security architecture

Vulnerability management

Incident response

ATO ownership

DevSecOps (Agile)

Education

Bachelor's degree in Cybersecurity, Computer Science, IT

Master's degree in Cybersecurity, Computer Science, IT

Tools

AWS Inspector

AWS Security Hub

IAM

KMS

CloudWatch

Job description

Cybersecurity Engineer - Health IT

Cormac Corporation Leesburg, Virginia, United States

About this position

CORMAC is seeking a Cybersecurity Engineer to safeguard the systems of the CMS Reporting and Quality division, which operate in the CMS AWS Cloud. This role guides teams on security policies and compliance and maintains a strong security posture across applications and cloud infrastructure. The Engineer works with CMS stakeholders on governance and works hands‑on with engineering and DevOps teams to implement required changes and drive remediation.

Responsibilities

• Provide guidance to Product Owners, ISSOs, engineering, and infrastructure staff on implementation of security policies, standards, and procedures
• Analyze and interpret CMS security requirements, including ARS 5, FISMA, FedRAMP, HIPAA, NIST, and Zero Trust directives, and communicate them clearly to non-security personnel
• Develop, update, and defend ATO artifacts such as System Security Plans, incident response plans, contingency plans, and related security documentation
• Conduct vulnerability and compliance assessments, review findings from AWS Inspector and AWS Security Hub, and determine severity and remediation priority
• Drive closure of security findings in close collaboration with developers, DevOps, and infrastructure engineers, including findings from container and code scans in CI/CD pipelines
• Secure the AWS environment, including IAM least-privilege access, KMS encryption, Security Groups, AWS Backup, CloudWatch monitoring, and logging
• Review and secure identity integration with HARP/IDM, including authentication, authorization, role mapping, and user access lifecycle
• Respond to alerts and security incidents, investigate and resolve higher level incidents, and maintain security tool dashboards and reporting
• Present vulnerability and compliance reviews to Government stakeholders and plan remediation or investigation activities
• Secure the Databricks environment, including workspace access controls, secrets management, encryption, and data protection for PII and PHI
• Track security findings, incidents, and remediation through ServiceNow, and monitor application and infrastructure logs using Amazon CloudWatch and New Relic
• Assess security and privacy implications of AI/LLM-enabled capabilities, and of PII and PHI handling, and educate teams on secure development practices

Basic Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
• Must be a U.S. Citizen
• Must be able to obtain a Public Trust (Tier I) Clearance
• Minimum of 8+ years of progressive experience in information security, cybersecurity engineering, or system security roles
• Proven experience owning and maintaining an Authorization to Operate (ATO), including authoring and defending security artifacts such as System Security Plans, Incident Response Plans, and contingency plans
• Demonstrated hands‑on experience managing vulnerability and compliance scanning and remediation programs using tools such as AWS Inspector and AWS Security Hub
• Strong hands‑on experience securing cloud‑based environments on AWS (IAM, KMS, Security Groups, CloudWatch)
• Working knowledge of FISMA, FedRAMP, NIST, ARS, and HIPAA requirements
• Ability to assess security findings, determine risk severity, prioritize remediation, and drive closure with engineering and DevSecOps teams
• Strong written and verbal communication skills, with the ability to explain security risks and remediation strategies to technical teams, leadership, and Government stakeholders, and to work within Agile (SAFe, Scrum, or Kanban) DevSecOps teams

Preferred Qualifications

• Master's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
• Federal government contracting experience supporting CMS or other health, civilian, or defense agencies
• Advanced industry security certifications such as CISSP, CISM, CRISC, or GIAC
• Cloud security certifications such as AWS Certified Security - Specialty or CCSP
• Experience securing CI/CD pipelines and containerized applications (Jenkins, GitHub, Docker, ECS, EKS)
• Experience with Zero Trust Architecture implementation
• Experience with Okta or Saviynt, or similar identity and governance solutions
• Experience facilitating incident response exercises and building security dashboards and metrics

Why CORMAC?

At CORMAC, we leverage the power of Data Management and Analytics to enable our customers to achieve their strategic goals. With over 20 years of experience in Health Information Technology (HIT), human-centered design principles and Agile development methodologies, CORMAC delivers complex digital solutions to solve some of the most challenging problems facing public healthcare programs today.

As a US Federal Government contractor in the public healthcare sector, our work is impactful and cutting‑edge while being performed in a supportive, collaborative, and welcoming environment. We offer flexible work schedules with remote, hybrid, or fully in‑person workplace options to empower our employees to decide the workplace most suitable for them. At CORMAC, we have a highly diverse workforce, and believe the work environment is a place where creativity, collaboration, enthusiasm, and innovation happens, regardless of location.

As an Equal Employment Opportunity employer, CORMAC provides equal employment opportunity to all employees and applicants without regard to an individual's protected status, including race/ethnicity, color, national origin, ancestry, religion, creed, age, gender, gender identity/expression, sexual orientation, marital status, parental status, including pregnancy, childbirth, or related conditions, disability, military service, veteran status, genetic information, or any other protected status.