Information Technology Specialist; Security

Millions of Americans rely on CMS websites every day. Help us secure them — with real automation, not just check boxes.

CMS's Web & Emerging Technologies Group is hiring an IT Specialist (Security) to lead security work as an Information System Security Officer (ISSO) for CMS websites — including CMS.gov, Healthcare.gov, and Medicare.gov. You'll drive contractors to build security into our Dev Sec Ops  pipeline — compliance-as-code, automated scanning, and real accountability for closing findings — while leading incident response and keeping our systems audit-ready.

As a IT Specialist (Security), GS-2210-13
, you will review, analyze, develop, publish, promote, and implement awareness of enterprise-wide HHS information technology (IT) security and/or system development life cycle (SDLC) policies and standards. Additionally, you will:

• Act as the ISSO (Information System Security Officer) ensuring staff and contractors meet security and risk framework requirements (NIST 800-53, FISMA, FedRAMP);
• Oversee contractor and vendor security performance by evaluating security impacts of changes, reviewing assessment findings, monitoring POA&Ms through closure, and ensuring compliance with CMS testing standards;
• Lead incident response and continuous monitoring by reporting security incidents in accordance with CMS Incident Handling Guidelines, coordinating with CMS security operations, and ensuring 24x7x365 monitoring coverage for assigned systems.

• Attention to Detail
• Customer Service
• Oral Communication
• Problem Solving

• 1) Applying security policies, standards, and risk management frameworks (such as NIST SP 800-53, FISMA, FedRAMP, or equivalent industry frameworks like ISO 27001 or SOC
  2) to assess, authorize, and continuously monitor the security posture of information systems;
• 2) Overseeing or advising on the integration of security controls into a Dev Sec Ops  pipeline, including compliance-as-code, automated vulnerability scanning, and automated generation of security control evidence;
• 3) Managing or coordinating third-party contractor or vendor security deliverables, including reviewing security assessment reports, tracking remediation of findings, and enforcing compliance with security requirements and timelines;
• 4) Leading or contributing to incident response activities, security control assessments, and the development or maintenance of system security documentation (such as System Security Plans, Contingency Plans, or Risk Assessment Reports).

Come see why over 6,000 employees say CMS is their employer of choice! In addition to dynamic and exciting opportunities, CMS offers generous compensation and benefits programs, an outstanding work-life balance, and most importantly, the opportunity to give back to your community, state, and country by making a difference in the lives of Americans everywhere.

For more information about careers at CMS, visit: (Use the "Apply for this Job" box below)..