CORMAC is seeking a Cybersecurity Engineer to safeguard the systems of the CMS Reporting and Quality division, which operate in the CMS AWS Cloud. This role guides teams on security policies and compliance and maintains a strong security posture across applications and cloud infrastructure. The Engineer works with CMS stakeholders on governance and works hands-on with engineering and DevOps teams to implement required changes and drive remediation.
Responsibilities:
Provide guidance to Product Owners, ISSOs, engineering, and infrastructure staff on implementation of security policies, standards, and procedures
Analyze and interpret CMS security requirements, including ARS 5, FISMA, FedRAMP, HIPAA, NIST, and Zero Trust directives, and communicate them clearly to non-security personnel
Develop, update, and defend ATO artifacts such as System Security Plans, incident response plans, contingency plans, and related security documentation
Conduct vulnerability and compliance assessments, review findings from AWS Inspector and AWS Security Hub, and determine severity and remediation priority
Drive closure of security findings in close collaboration with developers, DevOps, and infrastructure engineers, including findings from container and code scans in CI/CD pipelines
Secure the AWS environment, including IAM least-privilege access, KMS encryption, Security Groups, AWS Backup, CloudWatch monitoring, and logging
Review and secure identity integration with HARP/IDM, including authentication, authorization, role mapping, and user access lifecycle
Respond to alerts and security incidents, investigate and resolve higher level incidents, and maintain security tool dashboards and reporting
Present vulnerability and compliance reviews to Government stakeholders and plan remediation or investigation activities
Secure the Databricks environment, including workspace access controls, secrets management, encryption, and data protection for PII and PHI
Track security findings, incidents, and remediation through ServiceNow, and monitor application and infrastructure logs using Amazon CloudWatch and New Relic
Assess security and privacy implications of AI/LLM-enabled capabilities, and of PII and PHI handling, and educate teams on secure development practices
Basic Qualifications:
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
Must be a U.S. Citizen
Must be able to obtain a Public Trust (Tier I) Clearance
Minimum of 8+ years of progressive experience in information security, cybersecurity engineering, or system security roles
Proven experience owning and maintaining an Authorization to Operate (ATO), including authoring and defending security artifacts such as System Security Plans, Incident Response Plans, and contingency plans
Demonstrated hands-on experience managing vulnerability and compliance scanning and remediation programs using tools such as AWS Inspector and AWS Security Hub
Strong hands-on experience securing cloud-based environments on AWS (IAM, KMS, Security Groups, CloudWatch)
Working knowledge of FISMA, FedRAMP, NIST, ARS, and HIPAA requirements
Ability to assess security findings, determine risk severity, prioritize remediation, and drive closure with engineering and DevSecOps teams
Strong written and verbal communication skills, with the ability to explain security risks and remediation strategies to technical teams, leadership, and Government stakeholders, and to work within Agile (SAFe, Scrum, or Kanban) DevSecOps teams
Preferred Qualifications:
Master's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
Federal government contracting experience supporting CMS or other health, civilian, or defense agencies
Advanced industry security certifications such as CISSP, CISM, CRISC, or GIAC
Cloud security certifications such as AWS Certified Security - Specialty or CCSP
Experience securing CI/CD pipelines and containerized applications (Jenkins, GitHub, Docker, ECS, EKS)
Experience with Zero Trust Architecture implementation
Experience with Okta or Saviynt, or similar identity and governance solutions
Experience facilitating incident response exercises and building security dashboards and metrics
Experience securing Databricks or comparable large-scale data platforms
Why CORMAC?
At CORMAC, we leverage the power of Data Management and Analytics to enable our customers to achieve their strategic goals. With over 20 years of experience in Health Information Technology (HIT), human-centered design principles and Agile development methodologies, CORMAC delivers complex digital solutions to solve some of the most challenging problems facing public healthcare programs today.
As a US Federal Government contractor in the public healthcare sector, our work is impactful and cutting-edge while being performed in a supportive, collaborative, and welcoming environment.
We offer flexible work schedules with remote, hybrid, or fully in-person workplace options to empower our employees to decide the workplace most suitable for them. At CORMAC, we have a highly diverse workforce, and believe the work environment is a place where creativity, collaboration, enthusiasm, and innovation happens, regardless of location.
E-Verify Participation/EEO
As an Equal Employment Opportunity employer, CORMAC provides equal employment opportunity to all employees and applicants without regard to an individual's protected status, including race/ethnicity, color, national origin, ancestry, religion, creed, age, gender, gender identity/expression, sexual orientation, marital status, parental status, including pregnancy, childbirth, or related conditions, disability, military service, veteran status, genetic information, or any other protected status.