[Hiring] Information Security Officer @eSimplicity

Role Description

The Senior Information Security Analyst will provide security compliance, risk management, vulnerability management, audit, and continuous monitoring support for a Centers for Medicare & Medicaid Services (CMS) program. This role requires extensive knowledge of FISMA, the NIST Risk Management Framework, NIST SP 800-53, and CMS Acceptable Risk Safeguards (ARS).

• Independently develop and maintain detailed security control implementation statements.
• Evaluate supporting evidence and conduct Security Impact Analyses.
• Support Authorization to Operate activities and prepare systems for security assessments and audits.
• Manage vulnerability and compliance findings throughout their lifecycle.
• Work closely with CMS ISSOs, product owners, engineers, infrastructure teams, security assessors, auditors, and program leadership.
• Produce accurate, audit-ready security documentation.
• Identify compliance gaps and communicate security risks clearly.
• Drive assigned activities to completion with minimal supervision.

Qualifications

• Minimum of 8+ years of progressive experience in information security, cybersecurity engineering, or system security roles.
• A bachelor's degree in computer science, Information Systems, Engineering, Business, or other related scientific or technical discipline.
• Demonstrated experience supporting federal systems subject to FISMA and the NIST Risk Management Framework.
• Experience applying NIST SP 800-53 security and privacy controls and CMS ARS or comparable federal security requirements.
• Demonstrated experience developing, reviewing, and maintaining detailed, system-specific security control implementation statements and supporting evidence.
• Experience supporting ATO activities and maintaining System Security Plans, Security Impact Analyses, POA&Ms, risk assessments, contingency plans, incident response plans, configuration management plans, and related security artifacts.
• Experience leading or supporting security assessments and audits.
• Experience managing vulnerability and compliance findings through validation, assignment, remediation, mitigation, risk acceptance, retesting, and closure.
• Experience with vulnerability and compliance tools such as Tenable, Snyk, AWS Security Hub, AWS Inspector, or comparable platforms.
• Ability to prepare technically supported risk exception requests and vulnerability documentation.
• Demonstrated ability to develop accurate, audit-ready documentation and communicate security requirements, risks, findings, and remediation activities.
• Demonstrated ability to manage concurrent assignments and meet established deadlines.
• Ability to obtain and maintain a Public Trust clearance and have resided in the United States for at least 3 of the last 5 years.

Requirements

• Direct experience supporting CMS systems, CMS security programs, or CMS ATO activities.
• Advanced experience applying CMS ARS 5.0 or later to security control implementation, documentation, assessment, and continuous monitoring activities.
• Demonstrated expertise writing and reviewing security control statements.
• Experience leading control-statement reviews or control-mapping efforts.
• Experience conducting Security Impact Analyses for application, infrastructure, cloud, data, integration, and configuration changes.
• Experience supporting Security Control Assessments, FISMA audits, Office of Inspector General reviews, internal audits, penetration tests, or independent verification and validation activities.
• Experience communicating directly with CMS ISSOs, security assessors, auditors, system owners, and government program leadership.
• Experience securing or assessing AWS cloud environments.
• Familiarity with DevSecOps, CI/CD pipelines, source-code scanning, software composition analysis, container scanning, and security release reviews.
• Experience using Jira, Confluence, and ServiceNow to manage security documentation, vulnerabilities, compliance activities, risks, and corrective actions.
• Experience developing security metrics, dashboards, audit-readiness reports, vulnerability reports, and executive-level risk summaries.
• Current certification such as CISSP, CISM, CISA, CRISC, CAP/CGRC, CCSP, or an equivalent security or audit certification.
• Experience mentoring security analysts and performing quality reviews of security deliverables.

Benefits

• Comprehensive benefits package, including medical, dental, and vision coverage.
• 401(k) retirement benefits.
• Paid time off and paid holidays.
• Life and disability insurance.
• Additional wellness and employee support programs.