IT Specialist (Security)

This position is located in the Department of Health & Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), Office of Communications(OC), Web & Emerging Technologies Group (WETG), Division of Website Operations (DWO). As a IT Specialist (Security), GS-2210-13, you will review, analyze, develop, publish, promote, and implement awareness of enterprise-wide HHS information technology (IT) security and/or system development life cycle (SDLC) policies and standards.

Acts as ISSO for assigned WETG systems, ensuring ADOs and contractors meet security and risk framework requirements (NIST 800-53, FISMA, FedRAMP) across the authorization lifecycle, including control testing, risk decisions, and threat modeling.

Direct integration of security controls into the DevSecOps pipeline, guiding contractors on compliance-as-code (e.g., InSpec), automated vulnerability scanning, and evidence generation, while verifying automated results truly reflect compliance.

Oversee contractor and vendor security performance by assessing security impacts of changes, reviewing assessment reports, tracking POA-Ms to closure, enforcing CMS testing standards, and holding ADOs accountable to contract security commitments.

Drive incident response and continuous monitoring, reporting security incidents per CMS Incident Handling Guidelines, partnering with CMS security operations, and ensuring 24x7x365 monitoring coverage for assigned systems.

Keep security documentation current, including System Security Plans, Risk Assessment Reports, and Contingency Plans, and coordinates annual assessments and penetration testing to support Authority to Operate (ATO) decisions.