Information System Security Officer–Federal Programs

At Commence, we’re the start of a new age of data-centric transformation, elevating health outcomes and powering better, more efficient process to program and patient health. We combine quality data-driven solutions that fuel answers, technology that advances performance, and clinical expertise that builds trust to create a more efficient path to quality care.

With human-centered, healthcare-relevant, and value-based solutions, we create new possibilities with data. We provide proof beyond the concept and performance beyond the scope with a focus on efficiencies that transform the lives of those we serve. With a culture driven by purpose, straightforward communication and clinical domain expertise, Commence cuts straight to better care.?

The Information System Security Officer (ISSO) is the designated security officer and information assurance lead for the Commence systems that support federal programs. Reporting to the Information Systems Security Manager (ISSM), the ISSO owns the day-to-day security assessment, authorization, and continuous-monitoring work that keeps assigned systems authorized to operate for the federal agencies Commence supports directly as a prime contractor and indirectly as a subcontractor, including the Centers for Medicare & Medicaid Services (CMS), the Department of Veterans Affairs (VA), the Department of Defense / Defense Health Agency (DHA), the Internal Revenue Service (IRS), and the Department of Homeland Security / Transportation Security Administration (DHS/TSA).

The ISSM sets system assignments, which may be shared across more than one ISSO.

The ISSO works closely with the CIO, Cybersecurity Engineers, Compliance Analysts, Project Managers, and other departments across the company, including Operations, Engineering, Contracts, and Human Resources.

• ISSO designation and liaison. Serve as the designated ISSO for assigned federal systems and the primary system-level security liaison to agency ISSOs, Authorizing Officials, assessors, and prime contractor security teams; carry out priorities set by the CIO and ISSM; escalation program-level issues, risk acceptances, and exceptions to the ISSM with a recommended path.
• Project and cross-functional coordination. Partner with Project Managers to build security and authorization milestones into project plans, assess the security impact of system changes before they ship, and keep federal deliverable dates visible to project and program teams.
• ATO packages. Run the Security Assessment and Authorization lifecycle under the NIST Risk Management Framework (SP 800-37) from FIPS 199 categorization through authorization, ongoing authorization, and reauthorization. Author and maintain the System Security and Privacy Plan, risk assessment, Privacy Impact Assessment, contingency plan and annual test, incident response plan, configuration management plan, and interconnection agreements, for ISSM review.
• Continuous monitoring and POA&M. Maintain POA&M in agency GRC platforms; review monthly vulnerability and configuration scans against DISA STIGs, CIS benchmarks, and agency baselines; assign and track remediation with Cybersecurity Engineers and IT Operations to agency timelines; prepare ongoing-authorization and Con Mon reports.
• Agency assessments. Lead system-level preparation for CMS Security Controls Assessments and Adaptive Capabilities Testing, VA and DoD assessments, and IRS Safeguards reviews; work with Compliance Analysts on evidence collection and findings response.
• Agency-specific requirements. Maintain compliance with current and future agency requirements to include CMS ARS and IS2P2; VA Handbook 6500 and 6500.6; DFARS , NIST SP 800-171, and CMMC 2.0 for DoD/DHA; IRS Publication 1075 & 4812;…