Cybersecurity Engineer - Health IT

CORMAC is seeking a Cybersecurity Engineer to safeguard the systems of the CMS Reporting and Quality division, which operate in the CMS AWS Cloud. This role guides teams on security policies and compliance and maintains a strong security posture across applications and cloud infrastructure. The Engineer works with CMS stakeholders on governance and works hands-on with engineering and DevOps teams to implement required changes and drive remediation.

Responsibilities:

• Provide guidance to Product Owners, ISSOs, engineering, and infrastructure staff on implementation of security policies, standards, and procedures
• Analyze and interpret CMS security requirements, including ARS 5, FISMA, FedRAMP, HIPAA, NIST, and Zero Trust directives, and communicate them clearly to non-security personnel
• Develop, update, and defend ATO artifacts such as System Security Plans, incident response plans, contingency plans, and related security documentation
• Conduct vulnerability and compliance assessments, review findings from AWS Inspector and AWS Security Hub, and determine severity and remediation priority
• Drive closure of security findings in close collaboration with developers, DevOps, and infrastructure engineers, including findings from container and code scans in CI/CD pipelines
• Secure the AWS environment, including IAM least-privilege access, KMS encryption, Security Groups, AWS Backup, CloudWatch monitoring, and logging
• Review and secure identity integration with HARP/IDM, including authentication, authorization, role mapping, and user access lifecycle
• Respond to alerts and security incidents, investigate and resolve higher level incidents, and maintain security tool dashboards and reporting
• Present vulnerability and compliance reviews to Government stakeholders and plan remediation or investigation activities
• Secure the Databricks environment, including workspace access controls, secrets management, encryption, and data protection for PII and PHI
• Track security findings, incidents, and remediation through ServiceNow, and monitor application and infrastructure logs using Amazon CloudWatch and New Relic
• Assess security and privacy implications of AI/LLM-enabled capabilities, and of PII and PHI handling, and educate teams on secure development practices

Basic Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
• Must be a U.S. Citizen
• Must be able to obtain a Public Trust (Tier I) Clearance
• Minimum of 8+ years of progressive experience in information security, cybersecurity engineering, or system security roles
• Proven experience owning and maintaining an Authorization to Operate (ATO), including authoring and defending security artifacts such as System Security Plans, Incident Response Plans, and contingency plans
• Demonstrated hands-on experience managing vulnerability and compliance scanning and remediation programs using tools such as AWS Inspector and AWS Security Hub
• Strong hands-on experience securing cloud-based environments on AWS (IAM, KMS, Security Groups, CloudWatch)
• Working knowledge of FISMA, FedRAMP, NIST, ARS, and HIPAA requirements
• Ability to assess security findings, determine risk severity, prioritize remediation, and drive closure with engineering and DevSecOps teams
• Strong written and verbal communication skills, with the ability to explain security risks and remediation strategies to technical teams, leadership, and Government stakeholders, and to work within Agile (SAFe, Scrum, or Kanban) DevSecOps teams

Preferred Qualifications:

• Master's degree in Cybersecurity, Computer Science, Information Technology, or a similar field
• Federal government contracting experience supporting CMS or other health, civilian, or defense agencies
• Advanced industry security certifications such as CISSP, CISM, CRISC, or GIAC
• Cloud security certifications such as AWS Certified Security - Specialty or CCSP
• Experience securing CI/CD pipelines and containerized applications (Jenkins, GitHub, Docker, ECS, EKS)
• Experience with Zero Trust Architecture implementation
• Experience with Okta or Saviynt, or similar identity and governance solutions
• Experience facilitating incident response exercises and building security dashboards and metrics
• Experience securing Databricks or comparable large-scale data platforms

Why CORMAC?

At CORMAC, we leverage the power of Data Management and Analytics to enable our customers to achieve their strategic goals. With over 20 years of experience in Health Information Technology (HIT), human-centered design principles and Agile development methodologies, CORMAC delivers complex digital solutions to solve some of the most challenging problems facing public healthcare programs today.

As a US Federal Government contractor in the public healthcare sector, our work is impactful and cutting-edge while being performed in a supportive, collaborative, and welcoming environment. We offer flexible work schedules with remote, hybrid, or fully in-person workplace options to empower our employees to decide the workplace most suitable for them. At CORMAC, we have a highly diverse workforce, and believe the work environment is a place where creativity, collaboration, enthusiasm, and innovation happens, regardless of location.

E-Verify Participation/EEO

As an Equal Employment Opportunity employer, CORMAC provides equal employment opportunity to all employees and applicants without regard to an individual's protected status, including race/ethnicity, color, national origin, ancestry, religion, creed, age, gender, gender identity/expression, sexual orientation, marital status, parental status, including pregnancy, childbirth, or related conditions, disability, military service, veteran status, genetic information, or any other protected status.