System Security Officer (SSO)

Cogent People Inc.; Columbia (MD); Hybrid; USD 110,000 - 165,000; Full time

Job summary

Cogent People Inc. seeks an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, and regulatory compliance for CMS‑level systems.

You will assess vulnerabilities, perform security testing, and drive remediation with developers and operations teams. The role requires hands‑on security expertise, familiarity with federal frameworks, and the ability to lead security initiatives in a complex IT environment.

Qualifications

• Bachelor's degree in cybersecurity, IT, CS, or IS or equivalent experience.
• Hands-on information systems security, cybersecurity engineering, or related role.
• Experience with vulnerability assessments, scanning results, and remediation.
• Experience with SAST and DAST testing.
• Familiarity with federal security requirements and RMF/NIST 800-53.

Responsibilities

• Monitor security vulnerabilities and perform risk‑based remediation planning.
• Conduct SAST/DAST tests and translate findings into fixes for developers.
• Collaborate with engineers and ops teams to strengthen security posture.
• Support CMS/HHS compliance activities and security documentation.
• Provide technical leadership for security activities and risk management.

Skills

Security Operations

Vulnerability management

Application security

SAST/DAST

Security tooling

Education

Bachelor's degree in Cybersecurity/IT/CS/IS

Tools

SAST tools

DAST tools

CMS CFACTS

Job description

Description

Location: Columbia, MD (Hybrid/Remote – MON & WED in the office)

Residency Requirement: Candidates must have lived in the U.S. for at least 3 of the past 5 years and be authorized to work in the U.S. (Citizen, Permanent Resident, or EAD).

Sponsorship: This position does not offer any type of sponsorship. Candidates must already be authorized to work in the U.S. (e.g., Citizen, Permanent Resident, or EAD).

Clearance: Public Trust Clearance (or ability to obtain)

Job Overview: Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). This role is responsible for proactively identifying and assessing security vulnerabilities, conducting application security testing, supporting risk mitigation activities, and ensuring systems maintain compliance with CMS, Department of Health and Human Services (HHS), and overarching government security requirements.

The SSO will collaborate closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement effective security improvements. The position may also support Information System Security Officer as a Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. Success in this role requires strong technical cybersecurity expertise, hands‑on experience with security testing tools, familiarity with federal security frameworks, and the ability to proactively identify and address security risks in complex IT environments.

Responsibilities

• Security Operations & Vulnerability Management
• Proactively monitor and review security vulnerabilities identified through automated security scanning tools and continuous monitoring activities.
• Analyze security findings to identify false positives, non‑exploitable vulnerabilities, and legitimate security risks requiring remediation.
• Perform technical assessments of vulnerabilities to determine exploitability, severity, potential impact, and appropriate remediation strategies.
• Collaborate with development and operations teams to prioritize and resolve identified security vulnerabilities.
• Monitor remediation activities and validate corrective actions to ensure identified vulnerabilities have been appropriately addressed.
• Identify opportunities to strengthen system security configurations, vulnerability detection capabilities, and overall security posture.
• Application Security Testing & Security Engineering
• Perform in-depth Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved internal security tools.
• Analyze application security testing results, validate findings, and communicate actionable remediation recommendations to development teams.
• Work closely with software engineers to identify and mitigate application‑level vulnerabilities throughout the software development lifecycle.
• Support secure development practices and the integration of security controls into development, testing, and deployment processes.
• Participate in security tooling pilots, evaluations, and improvement initiatives to enhance security automation, detection, and hardening capabilities.
• Recommend improvements to security configurations, development practices, and operational processes to reduce security risks.
• CMS Security Compliance & ISSO Support
• Support compliance with applicable CMS and HHS cybersecurity policies, standards, and requirements, including CMS Acceptable Risk Safeguards (ARS).
• Perform assigned Information System Security Officer (ISSO) responsibilities in accordance with HHS Information Security and Privacy Policy requirements, including Appendix A, Section 19.
• Support applicable Program ISSO (P-ISSO) and System ISSO (S-ISSO) responsibilities established under CMS security and privacy policies.
• Support ISSO-as-a-Service (ISSOaaS) requirements, including security oversight, risk identification, compliance monitoring, and documentation activities.
• Maintain and update security and compliance information within CMS' Governance, Risk, and Compliance platform, CFACTS.
• Support Security Control Assessor and Contingency Planning Coordination duties as defined in applicable HHS security policies.
• Complete CMS-required ISSO training, including CFACTS and the seven CMS ISSO training modules, within 60 days of starting the assigned ISSO role.
• Security Assessments, Risk Management & Compliance
• Support preparation for CMS security assessments.
• Review security controls, supporting documentation, and technical evidence to identify potential compliance gaps.
• Coordinate with technical teams to collect documentation and evidence required for security assessments, audits, and compliance reviews.
• Support the identification, documentation, prioritization, and remediation of security risks and compliance findings.
• Assist with security control assessments, contingency planning, and continuous monitoring activities.
• Maintain accurate security documentation and communicate compliance risks, deficiencies, and recommended corrective actions to relevant stakeholders.
• Team Coordination & Technical Leadership
• Collaborate closely with developers, business analysts, operations personnel, infrastructure teams, and government security stakeholders to maintain awareness of system activities and potential security impacts.
• Participate in technical discussions, planning sessions, and operational reviews to proactively identify security implications of proposed system changes.
• Serve as a technical lead for assigned security activities, providing guidance and recommendations to team members.
• Provide backup support to the Project Lead for Operational Security and Privacy Support Services, as assigned.
• Communicate security findings, risks, remediation priorities, and recommendations clearly to both technical and nontechnical stakeholders.
• Promote security awareness, continuous improvement, and proactive risk management across development and operations teams.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field, or equivalent professional experience.
• Demonstrated professional experience in information systems security, cybersecurity engineering, application security, or a related technical security role.
• Hands‑on experience performing vulnerability assessments, analyzing security scanning results, and validating false positives and non‑exploitable findings.
• Experience conducting Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Strong understanding of application security vulnerabilities, remediation strategies, and secure software development practices.
• Experience working with security testing, vulnerability management, and continuous monitoring tools.
• Familiarity with federal cybersecurity requirements, security controls, and compliance frameworks, including NIST Risk Management Framework (RMF) and NIST SP 800‑53.
• Ability to evaluate technical security findings and translate them into actionable recommendations for development and operations teams.
• Experience supporting security assessments, compliance reviews, risk management activities, and security documentation.
• Ability to collaborate effectively with software development, infrastructure, operations,