Information System Security Officer-Federal Programs

Commence; Crystal Bay (NV); Remote; USD 110,000 - 160,000; Full time

Job summary

Commence is seeking an Information System Security Officer to lead security assessments and authorization for federal programs, reporting to the Information Security Manager. This role requires 5+ years of information assurance experience, including 3+ years as an ISSO or A&A lead, and a bachelor’s degree in a related field.

The ISSO will partner with the CIO, Cybersecurity Engineers, Compliance Analysts, and project teams to ensure RMF processes, prepare SSP/POA&M, and maintain agency-wide

Qualifications

• 5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems.
• Experience with RMF/NIST 800-37 and security documentation like SSP and POA&M.
• Familiar with CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Pub 1075/4812, DHS 4300A.
• Experience with vulnerability scanning outputs (Tenable Nessus, Defender, AWS Inspector) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• Ability to work with CIO, Compliance Analysts, project teams.

Responsibilities

• Serve as designated ISSO for assigned federal systems and liaison to agency ISSOs, Authorizing Officials, assessors and prime contractor security teams.
• Develop and maintain the System Security and Privacy Plan, risk assessment, contingency plan and annual test, incident response plan, configuration management plan, and interconnection agreements for ISSM review.
• Lead system-level security assessments and the RMF lifecycle from categorization to authorization and ongoing monitoring.
• Coordinate with CMS, VA, DoD, IRS assessments and prepare evidence with Compliance Analysts.
• Maintain compliance with CMS ARS/IS2P2, SOC 2, NIST CSF 800-53/800-171, HIPAA, HITRUST, ISO 27001; support audits and customer security questionnaires.
• Work with cross-functional teams to ensure security milestones are integrated into project plans.

Skills

Information assurance

Cybersecurity

ISSO experience

Federal information systems

NIST RMF

Remediation coordination

Education

Bachelor's degree in a related field

Tools

Tenable Nessus

Defender

AWS Inspector

SCAP/STIG Viewer

Job description

Description At Commence, we’re the start of a new age of data-centric transformation, elevating health outcomes and powering better, more efficient process to program and patient health. We combine quality data-driven solutions that fuel answers, technology that advances performance, and clinical expertise that builds trust to create a more efficient path to quality care.

With human-centered, healthcare-relevant, and value-based solutions, we create new possibilities with data. We provide proof beyond the concept and performance beyond the scope with a focus on efficiencies that transform the lives of those we serve. With a culture driven by purpose, straightforward communication and clinical domain expertise, Commence cuts straight to better care.?

The Information System Security Officer (ISSO) is the designated security officer and information assurance lead for the Commence systems that support federal programs. Reporting to the Information Systems Security Manager (ISSM), the ISSO owns the day-to-day security assessment, authorization, and continuous-monitoring work that keeps assigned systems authorized to operate for the federal agencies Commence supports directly as a prime contractor and indirectly as a subcontractor, including the Centers for Medicare & Medicaid Services (CMS), the Department of Veterans Affairs (VA), the Department of Defense / Defense Health Agency (DHA), the Internal Revenue Service (IRS), and the Department of Homeland Security / Transportation Security Administration (DHS/TSA). The ISSO works closely with the CIO, Cybersecurity Engineers, Compliance Analysts, Project Managers, and other departments across the company, including Operations, Engineering, Contracts, and Human Resources.

Serve as the designated ISSO for assigned federal systems and the primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams; escrow program-level issues, risk acceptances, and exceptions to the ISSM with a recommended path.

Project and cross-functional coordination. Partner with Project Managers to build security and authorization milestones into project plans, assess the security impact of system changes before they ship, and keep federal deliverable dates visible to project and program teams.

Run the Security Assessment and Authorization lifecycle under the NIST Risk Management Framework (SP 800-37) from FIPS 199 categorization through authorization, ongoing authorization, and reauthorization. Author and maintain the System Security and Privacy Plan, risk assessment, Privacy Impact Assessment, contingency plan and annual test, incident response plan, configuration management plan, and interconnection agreements, for ISSM review.

Maintain POA&Ms in agency GRC platforms; assign and track remediation with Cybersecurity Engineers and IT Operations to agency timelines; Lead system-level preparation for CMS Security Controls Assessments and Adaptive Capabilities Testing, VA and DoD assessments, and IRS Safeguards reviews; work with Compliance Analysts on evidence collection and findings response.

Maintain compliance with current and future agency requirements to include CMS ARS and IS2P2; Act as first responder for security and privacy incidents affecting federal data on assigned systems; escape immediately to the ISSM and CIO; meet agency notification clock in coordination with the Privacy Officer and prime contractors.

Contract deliverables and personnel security. Complete system-level contract security deliverables; manage federal personnel security tasks (Public Trust and e-QIP processing, agency training, rules of behavior, access attestation). Support the CIO and ISSM with internal audits and control assessments against SOC 2, NIST (CSF, SP 800-53, SP 800-171), HIPAA, HITRUST, and ISO/IEC 27001 frameworks: control testing, evidence preparation, gap analysis, and corrective action, capturing tracking. Provide system-specific input to the ISSM and Compliance Analyst, who owns external audits and customer and prime contractor security questionnaires.

5+ years of information assurance or cybersecurity experience, including 3+ years as an ISSO or A&A lead for federal information systems; bachelor’s degree in a related field or equivalent experience.

• Has personally taken at least one federal system through an initial ATO or reauthorization under NIST SP , including SSP authorship and POA&M management in various agency specific GRC platforms.
• Working knowledge of at least two of: CMS ARS/IS2P2, VA 6500, DoD RMF and NIST SP 800-171/CMMC, IRS Publication 1075 & 4812, DHS 4300A. Comfortable reading vulnerability and configuration scan output (Tenable/Nessus, Defender, AWS Inspector, SCAP/STIG Viewer) and translating findings into remediation tasks.
• Familiarity with AWS and Microsoft 365/Azure.
• Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

This is a remote position with an estimated 15-25% travel. Candidates must be able to sit, read, work on a computer, and watch a computer screen for extended periods of time. Commence' headquarters are in Virginia Beach, VA, however we are open to remote candidates in the following states: All personnel processes are merit-based and applied without discrimination on the basis of race, color, religion, sex, sexual orientation, gender identity, marital status, age, disability, national or ethnic origin, military and veteran status or any other characteristic protected by applicable law.

Commence is committed to providing equal employment opportunities to all applicants, including individuals with disabilities. If you require a reasonable accommodation to participate in the application process due to a disability, please contact Human Resources at or note that unless you are requesting an accommodation, all applications must be submitted through our online application system.