> Markdown version of [/jobs/ext/565700-information-security-analyst-3](https://www.wearedevelopers.com/jobs/ext/565700-information-security-analyst-3). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Analyst 3 - **Company:** Chags Health Information Technology LLC - **Location:** Columbia, MD, United States (Remote available) - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Microsoft Word, Microsoft Excel, Agile Methodology, Amazon Web Services, Software System Penetration Testing, Microsoft Outlook, Cloud Computing, Cyber Security, Information Systems, Computer Networks, Dynamic Host Configuration Protocol, DevOps, Domain Name System (DNS), Virtual Private Networks (VPN), Microsoft Office, Routing, Microsoft PowerPoint, SAP (Applications), SonarQube, Virtual Local Area Networks, Web Applications, Information Security Management System, Devsecops, Static Application Security Testing, Dynamic Application Security Testing - **Published:** June 14, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=a69030b5b94f31fa ## About the Role Do you have experience in Vendor communication?, * 3+ years of experience with NIST and Federal security documentation. * Active CISSP or equivalent security related certification. * Capable of obtaining Level Five: Public Trust security clearance. * Proven experience with FISCAM and FedRAMP requirements. * Experience writing and maintaining security related documents, including the System Security Plan (SSP), Contingency Plan and Test (CP), Information System Risk Assessment (ISRA), Security Assessment Plan/Report (SAP/SAR) and the Privacy Impact Assessment (PIA). * Ability to resolve complex support issues by leveraging user forums, support forums, or opening support cases with vendors and following them to closure. Strong ability to find mitigation and alternative approaches. * Knowledge of current as well as emerging security threats. * Understanding of and experience with Agile Development and DevSecOps/DevOps. * Proven experience with Cloud Technologies (AWS) * Proven experience with Microsoft Office Tools (Outlook, Word, Excel, PowerPoint). Desired Skills and Certifications: * Working experience within CMS including with CMS Information Systems Security and Privacy Policy (IS2P2), NIST 800-53, NIST 800-63, CMS Acceptable Risk Safeguards (ARS), CMS Risk Management Handbook (RMH) and CMS Federal Information Security Management Act (FISMA) Controls Tracking System (CFACTS). * Proven experience with Security tools such as Burp, SonarQube, AWS Security Tools * Proven experience with networking concepts, such as, DHCP, DNS, VLANs, Routing and VPNs ## Description Job Description: The Information Security Officer (ISO) will work closely with Project and Technical management to plan, design and implement Dynamic Application Security Testing (DAST) and/or Static Application Security Testing (SAST) security methodologies into the technical solution of a program within the Centers for Medicare and Medicaid Services (CMS). The ISO will be responsible for assuring all CMS security and privacy considerations and requirements are assessed, addressed and documented for the given application, designing the solution so that it passes the required Annual Security Assessment Testing (within CMS referred to ACT or Adaptive Capabilities Testing) and maintains the system Authority to Operate (ATO). The primary responsibilities of the position include but are not limited to: * Promote a professional work ethic with the ability to meet commitments, scheduled timelines and take ownership of problems. * Lead, support and document all security incident response activities. * Perform annual security assessment audits (such as ACT, PenTest, etc.). * Perform Web Application Penetration and Continuous Diagnostic Monitoring (CDM) testing. * Mitigate and/or address the security specific vulnerabilities and document via Plan of Action and Milestones (POA&M). * Support ad hoc security requests from the customer and program management. * Conduct security impact assessments for new or existing architecture changes. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Creating a routing app with Google Maps API from scratch](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)