System Security Officer; SSO

Description

Location: Columbia, MD (Hybrid/Remote – MON & WED in the office)

Residency Requirement: Candidates must have lived in the U.S. for at least 3 of the past 5 years and be authorized to work in the U.S. (Citizen, Permanent Resident, or EAD).

Sponsorship: This position does not offer any type of sponsorship. Candidates must already be authorized to work in the U.S. (e.g., Citizen, Permanent Resident, or EAD).

Clearance: Public Trust Clearance (or ability to obtain)

Cogent People Inc. is seeking an experienced System Security Officer (SSO) to support cybersecurity operations, vulnerability management, application security, and regulatory compliance for mission-critical systems supporting the Centers for Medicare & Medicaid Services (CMS). This role is responsible for proactively identifying and assessing security vulnerabilities, conducting application security testing, supporting risk mitigation activities, and ensuring systems maintain compliance with CMS, Department of Health and Human Services (HHS), and overarching government security requirements.

The SSO will collaborate closely with software developers, operations teams, security engineers, and government stakeholders to identify security risks, validate findings, and implement effective security improvements. The position may also support Information System Security Officer as a Service (ISSOaaS) requirements, including security assessments, contingency planning, compliance documentation, and security oversight. Success in this role requires strong technical cybersecurity expertise, hands‑on experience with security testing tools, familiarity with federal security frameworks, and the ability to proactively identify and address security risks in complex IT environments.

• Security Operations & Vulnerability Management
  • Proactively monitor and review security vulnerabilities identified through automated security scanning tools and continuous monitoring activities.
  • Analyze security findings to identify false positives, non‑exploitable vulnerabilities, and legitimate security risks requiring remediation.
  • Perform technical assessments of vulnerabilities to determine exploitability, severity, potential impact, and appropriate remediation strategies.
  • Collaborate with development and operations teams to prioritize and resolve identified security vulnerabilities.
  • Monitor remediation activities and validate corrective actions to ensure identified vulnerabilities have been appropriately addressed.
  • Identify opportunities to strengthen system security configurations, vulnerability detection capabilities, and overall security posture.
• Application Security Testing & Security Engineering
  • Perform in-depth Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) using approved internal security tools.
  • Analyze application security testing results, validate findings, and communicate actionable remediation recommendations to development teams.
  • Work closely with software engineers to identify and mitigate application‑level vulnerabilities throughout the software development lifecycle.
  • Support secure development practices and the integration of security controls into development, testing, and deployment processes.
  • Participate in security tooling pilots, evaluations, and improvement initiatives to enhance security automation, detection, and hardening capabilities.
  • Recommend improvements to security configurations, development practices, and operational processes to reduce security risks.
• CMS Security Compliance & ISSO Support
  • Support compliance with applicable CMS and HHS cybersecurity policies, standards, and requirements, including CMS Acceptable Risk Safeguards (ARS).
  • Perform assigned Information…