ResponsibilitiesPeraton is seeking a Mid-level DevSecOps Engineer to join our team of qualified, diverse professionals. In this role, you will support the security, reliability, and compliance of mission‑critical systems within the DME Program. The ideal candidate will play a key part in integrating security throughout the development lifecycle, maintaining adherence to federal cybersecurity standards, and ensuring the operational readiness of modernized systems at the Centers for Medicare & Medicaid Services (CMS). This position supports a highly visible environment where strong technical execution, security rigor, and cross‑team collaboration are essential.
Responsibilities:
- Serve as the Information System Security Officer (ISSO) for the ClaimsCore Program, ensuring full compliance with FISMA Moderate, FedRAMP Moderate, and CMS ARS 5.1 security requirements.
- Prepare, maintain, and update all Certification and Accreditation (C&A) and Security Assessment and Authorization (SA&A) documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), Contingency Plans, and Plan of Action and Milestones (POA&Ms).
- Conduct and document ongoing risk assessments, vulnerability assessments, and security control evaluations across the program’s cloud and on‑premises environments.
- Manage and coordinate the Authority to Operate (ATO) lifecycle, including initial authorization, continuous monitoring, control implementation reviews, and audit preparation.
- Ensure zero open Critical or High vulnerabilities at system go-live and maintain compliance with vulnerability remediation SLAs.
- Respond to and manage security incident notifications within required timelines (1 hour for initial reporting). Coordinate with internal security teams and external stakeholders to support incident response processes.
- Support internal and external audits, including CSRAP, CFO, OMB A‑123, and annual security assessments.
- Collaborate with DevOps, engineering, and operations teams to integrate security best practices into CI/CD pipelines, infrastructure-as-code, and deployment processes.
- Monitor and enhance security posture using tools such as vulnerability scanners, SIEM platforms, configuration management tools, and compliance automation platforms.
- Contribute to continuous improvement of security procedures, engineering practices, and system hardening baselines.
- Assist in the implementation and maintenance of cloud security configurations aligned with agency and program requirements.
- Provide security guidance during architecture reviews, design sessions, sprint planning, and change control processes.
- Ensure security documentation, diagrams, inventories, and boundary definitions are accurate and up to date.
Qualifications
Qualifications (Required):
- Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or related field; additional experience may be substituted in lieu of degree.
- 5 to 7 years of experience in cybersecurity, DevSecOps, or system engineering roles supporting federal programs.
- Experience acting as an ISSO or security engineer for a FISMA Moderate or FedRAMP Moderate system.
- Hands-on experience preparing security authorization documentation such as SSPs, SARs, POA&Ms, and Continuous Monitoring updates.
- Strong understanding of NIST 800‑53 security controls, Risk Management Framework (RMF), CMS ARS 5.1, and continuous monitoring requirements.
- Practical experience supporting or integrating security processes in DevSecOps pipelines, CI/CD workflows, or automated deployment environments.
- Experience with vulnerability management tools and processes, including scanning, analysis, and remediation tracking.
- Ability to support audits and communicate effectively with assessment teams, program stakeholders, and government security representatives.
- U.S. citizenship and the ability to obtain and maintain a public trust or equivalent clearance.
Qualifications (Preferred):
- Experience supporting CMS programs or other HHS components.
- Familiarity with FedRAMP documentation, cloud boundary definitions, and cloud-native security practices.
- Experience with AWS or Azure security services, cloud configuration baselines, and cloud compliance frameworks.
- Working knowledge of tools commonly used within Peraton and similar enterprises, such as GitLab/GitHub CI/CD, Jenkins, Terraform, Ansible, Tenable, Splunk, or similar platforms.
- Security certifications such as Security+, CISSP, CISM, CCSP, or AWS/Azure security certifications.
- Experience integrating legacy systems into modern cloud or hybrid architectures with secure migration practices.
- Knowledge of container security (Docker, Kubernetes) and infrastructure-as-code security scanning.
Target Salary Range$66,000 - $106,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
