RemoteLeaf Logo
Log in Sign up

Information Systems Security Officer I (ISSO-1)

1 month, 1 week ago
United States
Full-time
Mid Level
Security Engineer
DevOps and Infrastructure
Ansible AWS Chef CloudFormation Hadoop Kubernetes Load Balancing Machine Learning MapReduce Puppet REST API Terraform
Apply Now
Bellese Technologies

Bellese Technologies

Bellese Technologies is a civic technology company dedicated to improving the healthcare journey through civic innovation. They are not just digital service providers but partners, recognized for their top workplace culture and commitment to quality ca...

Internet Software & Services
51-250
Founded 2009
View All Jobs 22

Description

  • Proactively identify system changes in HQR and QMARS and document them in Security Impact Analyses to keep the Authority to Operate valid.
  • Serve as the source of truth for the systems’ security posture in CFACTS by managing control implementation statements and evidence.
  • Lead audit preparation and defense by gathering screenshots, logs, and process documentation to demonstrate control effectiveness to CMS auditors.
  • Attend sprint ceremonies for both HQR and QMARS to advise developers on CMS security standards early in the build process.
  • Track security weaknesses through remediation and ensure issues are resolved within CMS 30/60/90-day patching windows.
  • Review and maintain program documentation such as Contingency Plans and Incident Response Plans for annual FISMA sign-off.
  • Collaborate with infrastructure and feature development teams to identify risks, design countermeasures, and reduce security rework.
  • Translate technical vulnerabilities from scans into clear POA&Ms that developers can act on.
  • Support the Assessment & Authorization lifecycle to achieve or maintain ATO status.

Requirements

  • U.S. citizenship or documented eligibility to work in the U.S. without sponsorship.
  • U.S. residency for at least the past 3 years.
  • Ability to meet Public Trust requirements and successfully complete a U.S. government background investigation.
  • At least 4 years of experience establishing security controls in a similar environment.
  • Experience with two or more of the following: web application development, Unix/Linux environments, distributed systems, machine learning, large-scale systems and API services, or security software development.
  • Experience with one or more infrastructure scripting or orchestration tools such as Terraform, CloudFormation, Ansible, Chef, Puppet, or Kubernetes.
  • Experience implementing two or more cloud-based solutions, such as virtual clouds, serverless computing, load balancing and networking, data storage, data streaming, Hadoop, MapReduce, or secured REST-based API endpoints.
  • Direct hands-on experience with CFACTS, preferably in a CMS environment.
  • Proven ability to author Security Impact Analyses, System Security Plans, and Privacy Impact Assessments under NIST 800-53 Rev. 5 and CMS ARS 5.0.
  • Experience taking a system through the Assessment & Authorization process to achieve or maintain an Authority to Operate.
  • Ability to interpret Tenable/Nessus or WebInspect scans and convert findings into developer-friendly POA&Ms.
  • Understanding of how to document security controls for AWS-native services.

Benefits

  • Remote-first, remote-only work culture.
  • Four weeks of paid time off per year, prorated in the first year.
  • 10 paid floating company holidays.
  • Flexible schedule.
  • Work-from-home setup including a MacBook.
  • Medical, dental, and company-paid vision insurance.
  • Optional HSA with company contribution on some medical plans.
  • Company-paid basic life, AD&D, and short- and long-term life insurance coverage.
  • 401(k) plan with a 3% safe harbor contribution.
  • Wellness resources, virtual care, and employee discounts.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

INflow Federal

DevSecOps Engineer

INflow Federal 51-250 Aerospace & Defense

INflow Federal is seeking a fully remote DevSecOps Engineer to support an enterprise case management solution for Department of Defense mission partners by securing and automating cloud-based CI/CD and infrastructure operations in AWS GovCloud.

United States Full-time Senior DevOps Engineer Security Engineer
Agile AWS Bash CI/CD CloudFormation Docker ELK Stack Git GitLab CI Helm Jenkins Kubernetes PowerShell Prometheus Python Terraform
1 hour, 36 minutes ago
Klaviyo

Lead Security Engineer, Enterprise Security

Klaviyo 1K-5K IT Services

Klaviyo is hiring a Lead Security Engineer to secure its corporate systems and platforms across SaaS, identity, endpoints, Zero Trust networking, and perimeter security.

United States Full-time Lead Security Engineer
$175k-$263k
AWS Azure Cloudflare CrowdStrike GCP OAuth Secrets Management Terraform Vercel
2 hours, 16 minutes ago
Anduril Industries

Senior Detection and Response Engineer

Anduril Industries 1K-5K Aerospace & Defense

Anduril Industries is hiring a Senior Detection and Response Engineer to build and operate defensive security controls that protect the infrastructure supporting its defense technology products.

United States Full-time Senior Security Engineer
$166k-$220k
AWS Azure CI/CD CloudFormation Docker GitHub Go Kubernetes Network Security Python Rust SQL Terraform
3 hours, 57 minutes ago
Klaviyo

Lead Security Engineer, Enterprise Security

Klaviyo 1K-5K IT Services

Klaviyo is hiring a Lead Security Engineer to secure its corporate systems and platforms across SaaS, identity, endpoints, Zero Trust networking, and perimeter defenses in a hands-on technical leadership role.

United States Full-time Lead Security Engineer
$175k-$263k
AWS Azure Cloudflare CrowdStrike GCP OAuth OpenID Connect Secrets Management Terraform Vercel
4 hours, 30 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers