System Security Officer (SSO)

Cogent People Inc; Columbia (MD); Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

Health, Dental, and Vision Insurance

401(k) Plan

Life Insurance & Disability Coverage

Paid Time Off

Job summary

Cogent People Inc. in Columbia, MD is seeking an experienced System Security Officer to support CMS cybersecurity operations, vulnerability management, and regulatory compliance for mission-critical systems.

You will collaborate with developers, security engineers, and government stakeholders to identify risks, validate findings, and implement improvements while maintaining compliance with CMS ARS, RMF, and HHS policies.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, or equivalent.
• Hands-on vulnerability assessment and remediation experience.
• Experience with SAST/DAST and modern secure SDLC practices.

Responsibilities

• Monitor and triage security vulnerabilities from scans and monitoring tools.
• Lead remediation prioritization with development and ops teams.
• Perform SAST/DAST testing and communicate actionable fixes.
• Support CMS/HHS compliance activities and risk management.
• Provide technical leadership and guidance on security practices.

Skills

Cybersecurity

Vulnerability Management

App Security

Security Testing

Education

Bachelor's degree in Cybersecurity or related field

Tools

SAST Tools

DAST Tools

Fortify

OWASP ZAP

Checkmarx

CFACTS

Job description

Description

Location: Columbia, MD (Hybrid/Remote – MON & WED in the office)

Residency Requirement: Candidates must have lived in the U.S. for at least 3 of the past 5 years and be authorized to work in the U.S. (Citizen, Permanent Resident, or EAD).

Sponsorship: This position does not offer any type of sponsorship. Candidates must already be authorized to work in the U.S. (e.g., Citizen, Permanent Resident, or EAD).

Clearance: Public Trust Clearance (or ability to obtain)

Job Overview:

Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). This role is responsible for proactively identifying and assessing security vulnerabilities, conducting application security testing, supporting risk mitigation activities, and ensuring systems maintain compliance with CMS, Department of Health and Human Services (HHS), and overarching government security requirements.

The SSO will collaborate closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement effective security improvements. The position may also support Information System Security Officer as a Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. Success in this role requires strong technical cybersecurity expertise, hands‑on experience with security testing tools, familiarity with federal security frameworks, and the ability to proactively identify and address security risks in complex IT environments.

Responsibilities:

• Security Operations & Vulnerability Management
  • Proactively monitor and review security vulnerabilities identified through automated security scanning tools and continuous monitoring activities.
  • Analyze security findings to identify false positives, non‑exploitable vulnerabilities, and legitimate security risks requiring remediation.
  • Perform technical assessments of vulnerabilities to determine exploitability, severity, potential impact, and appropriate remediation strategies.
  • Collaborate with development and operations teams to prioritize and resolve identified security vulnerabilities.
  • Monitor remediation activities and validate corrective actions to ensure identified vulnerabilities have been appropriately addressed.
  • Identify opportunities to strengthen system security configurations, vulnerability detection capabilities, and overall security posture.
• Application Security Testing & Security Engineering
  • Perform in-depth Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved internal security tools.
  • Analyze application security testing results, validate findings, and communicate actionable remediation recommendations to development teams.
  • Work closely with software engineers to identify and mitigate application‑level vulnerabilities throughout the software development lifecycle.
  • Support secure development practices and the integration of security controls into development, testing, and deployment processes.
  • Participate in security tooling pilots, evaluations, and improvement initiatives to enhance security automation, detection, and hardening capabilities.
  • Recommend improvements to security configurations, development practices, and operational processes to reduce security risks.
• CMS Security Compliance & ISSO Support
  • Support compliance with applicable CMS and HHS cybersecurity policies, standards, and requirements, including CMS Acceptable Risk Safeguards (ARS).
  • Perform assigned Information System Security Officer (ISSO) responsibilities in accordance with HHS Information Security and Privacy Policy requirements, including Appendix A, Section 19.
  • Support applicable Program ISSO (P‑ISSO) and System ISSO (S‑ISSO) responsibilities established under CMS security and privacy policies.
  • Support ISSO‑as‑a‑Service (ISSOaaS) requirements, including security oversight, risk identification, compliance monitoring, and documentation activities.
  • Maintain and update security and compliance information within CMS' Governance, Risk, and Compliance platform, CFACTS.
  • Support Security Control Assessor and Contingency Planning Coordination duties as defined in applicable HHS security policies.
  • Complete CMS‑required ISSO training, including CFACTS and the seven CMS ISSO training modules, within 60 days of starting the assigned ISSO role.
• Security Assessments, Risk Management & Compliance
  • Support preparation for CMS security assessments.
  • Review security controls, supporting documentation, and technical evidence to identify potential compliance gaps.
  • Coordinate with technical teams to collect documentation and evidence required for security assessments, audits, and compliance reviews.
  • Support the identification, documentation, prioritization, and remediation of security risks and compliance findings.
  • Assist with security control assessments, contingency planning, and continuous monitoring activities.
  • Maintain accurate security documentation and communicate compliance risks, deficiencies, and recommended corrective actions to relevant stakeholders.
• Team Coordination & Technical Leadership
  • Collaborate closely with developers, business analysts, operations personnel, infrastructure teams, and government security stakeholders to maintain awareness of system activities and potential security impacts.
  • Participate in technical discussions, planning sessions, and operational reviews to proactively identify security implications of proposed system changes.
  • Serve as a technical lead for assigned security activities, providing guidance and recommendations to team members.
  • Provide backup support to the Project Lead for Operational Security and Privacy Support Services, as assigned.
  • Communicate security findings, risks, remediation priorities, and recommendations clearly to both technical and nontechnical stakeholders.
  • Promote security awareness, continuous improvement, and proactive risk management across development and operations teams.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field, or equivalent professional experience.
• Demonstrated professional experience in information systems security, cybersecurity engineering, application security, or a related technical security role.
• Hands‑on experience performing vulnerability assessments, analyzing security scanning results, and validating false positives and non‑exploitable findings.
• Experience conducting Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Strong understanding of application security vulnerabilities, remediation strategies, and secure software development practices.
• Experience working with security testing, vulnerability management, and continuous monitoring tools.
• Familiarity with federal cybersecurity requirements, security controls, and compliance frameworks, including NIST Risk Management Framework (RMF) and NIST SP 800-53.
• Ability to evaluate technical security findings and translate them into actionable recommendations for development and operations teams.
• Experience supporting security assessments, compliance reviews, risk management activities, and security documentation.
• Ability to collaborate effectively with software development, infrastructure, operations, and cybersecurity teams.
• Strong attention to detail with a commitment to delivering high‑quality and accurate work.
• Proven ability to manage time and prioritize tasks in a fast‑paced environment.
• Demonstrated problem‑solving skills with a proactive and solution‑oriented mindset.

Preferred Qualifications

• Direct experience supporting CMS information systems, cybersecurity operations, or security compliance activities.
• Experience serving as a System Security Officer (SSO) or Information System Security Officer (ISSO) within CMS, HHS, or another federal agency.
• Working knowledge of CMS Acceptable Risk Safeguards (ARS) and applicable CMS security and privacy policies.
• Hands‑on experience with CFACTS, CMS' Governance, Risk, and Compliance platform.
• Experience preparing for or supporting CMS Security Risk Assessment Program (CSRAP) assessments.
• Familiarity with HHS Information Security and Privacy Policy requirements, including P‑ISSO and S‑ISSO responsibilities.
• Experience supporting Authorization to Operate (ATO) activities, security control assessments, Plans of Action and Milestones (POA&Ms), and continuous monitoring.
• Experience with federal contingency planning and security assessment coordination.
• Experience with DevSecOps practices, CI/CD pipelines, automated security testing, and security integration within Agile software development environments.
• Familiarity with application security testing tools such as Fortify, Checkmarx, SonarQube, Burp Suite, OWASP ZAP, or similar tools.
• Experience participating in security hardening initiatives, security automation efforts, or cybersecurity tool evaluations.
• Relevant cybersecurity certifications such as CISSP, CISM, CompTIA Security+, Certified Authorization Professional (CAP/CGRC), or equivalent.
• Experience providing technical leadership, mentoring security personnel, or coordinating security activities across multidisciplinary teams.

Why Cogent People Inc.?

At Cogent People, we foster a collaborative, growth‑driven environment where innovation thrives. You’ll be part of a team working on mission‑critical technology solutions that make a real impact. We offer competitive salaries, career development opportunities, and the chance to contribute to meaningful projects that shape the future.

As a Certified Great Place to Work, we prioritize employee satisfaction and provide a supportive, inclusive culture where every team member is valued and empowered to succeed.

Benefits

• Health, Dental, and Vision Insurance: Comprehensive coverage.
• 401(k) Plan: Matching contributions.
• Life Insurance & Disability Coverage: Company‑paid life, short‑term, and long‑term disability insurance.
• Paid Time Off: 3 weeks of PTO annually, plus 10 holidays.

EEO Employer

Cogent People Inc. is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, gender, gender identity, sexual orientation, age, disability status, or any other status protected by law.