Information Security Analyst

Quantum Sky is seeking a Senior Information Security Analyst to serve as the operational security guardian for the DHA E-Commerce System (ECS). This onsite role in Aurora, CO focuses on continuous monitoring, security analytics, incident handling, vulnerability mitigation and compliance tracking, and supporting Risk Management Framework (RMF) Authority to Operate (ATO) efforts to maintain status.

Core responsibilities

• Maintain and execute the DHA ECS Continuous Monitoring Plan in alignment with NIST SP 800-137, DoDI 8510.01, and DHA cybersecurity directives.
• Continuously monitor the security posture of DHA ECS web applications, relational databases (Oracle), and cloud infrastructure hosted in MedCOI AWS GovCloud East to detect unauthorized activity, anomalies, and system degradation.
• Routinely monitor, analyze, and maintain security risk posture in DHA Data Center Operations (DCOPS) Continuous Monitoring and Risk Scoring (CMRS), investigating risk score variances and coordinating remediation actions.
• Track and respond to cyber directives, operational orders, and taskers recorded in the CYOC Issuance Tracker (CIT), ensuring timely status reporting and technical mitigation.
• Administer, configure, and maintain the DHA ECS security monitoring toolset, including Splunk Universal Forwarders, ACAS / Tenable Nessus scanners and agents, HBSS / Trellix ESS clients, and Burp Suite Professional.
• Configure and verify Splunk log forwarders on RHEL and Windows Server systems to aggregate and normalize operating system, web server (Apache, IIS, WebLogic), and database audit logs into DCOPS-hosted Splunk enterprise repositories.
• Develop tailored Splunk search queries, correlation rules, dashboards, and automated alerting thresholds for events such as privilege escalation, failed authentications, brute-force activity, and unauthorized configuration modifications.
• Plan, schedule, and execute credentialed vulnerability scans using ACAS / Tenable Nessus across virtual machines and database listeners; analyze results, reduce false positives, and deliver prioritized remediation plans to engineering.
• Oversee HBSS/ESS agent operational health, confirming Host Intrusion Prevention System (HIPS), Data Loss Prevention (DLP), and VirusScan Enterprise modules remain active, correctly policy-assigned, and communicating with the ePO console.
• Lead security incident response activities, including detection, initial triage, containment, eradication, and post-incident analysis in accordance with CJCSM 6510.01B ("Cyber Incident Handling Program") and DoD 8510.1-M.
• Perform technical event analysis across network boundaries, host logs, and application layers to establish root cause and impact on CUI, PII, and PHI.
• Coordinate incident notifications and operational status reporting with the ISSM, ISSO, DHA Global Service Center (GSC), and DCOPS CYOC.
• Write comprehensive After-Action Reports (AARs) and incident post-mortems, capturing preventive controls and lessons learned for inclusion in the Security Management and Assessment Plan (CDRL 0012).
• Monitor and track IAVAs, IAVBs, and Technical Advisories from USCYBERCOM and DISA, assessing applicability across DHA ECS software stacks and operating environments.
• Partner with system and database teams to verify patches and STIG configurations are applied within mandated compliance windows.
• Maintain and manage security weakness status in eMASS Plan of Action and Milestones (POA&M), updating entries and ensuring review no later than ten (10) calendar days before expiration.
• Collect and package mitigation artifacts (scan deltas, script outputs, system screenshots) to support POA&M closure and Authorization to Operate with Conditions / Risk Acceptance (AOR) requests.
• Conduct quarterly user account and privileged permission audits across Development, System Test, QA/Pre-Prod, and Production environments to verify compliance with the DHA ECS Segregation of Duties (SOD) matrix and reduce dormant accounts.
• Inspect and maintain the program’s whitelisted IP registry for approved external Extranet, PRISM, SFTP, and data mart connections.
• Support triennial ATO renewal and annual RMF self-assessments by providing continuous monitoring metrics, tool configuration checklists, audit logs, and compliance evidence.
• Prepare technical responses and supporting evidence for cyber data calls, inspections, and audits from USCYBERCOM, DISA, DHA J6, and financial audit authorities.

Required qualifications

• U.S. citizenship: must be a United States Citizen (DHA network account, privileged IT-II access, and eMASS authorization); dual citizenship cannot be accepted.
• IAT Level II certification upon hire (examples provided): CompTIA Security+ ce, CCNA-Security, CySA+, GICSP, GSEC, or SSCP.
• Education: Bachelor’s degree from an accredited university in Information Assurance, Cybersecurity, Computer Science, Engineering, Information Systems, or a related discipline, OR fifteen (15) years of documented experience in Information Assurance / IT Cybersecurity as a substitute.
• Experience: minimum five (5) years hands-on experience supporting enterprise applications, databases, and infrastructure comparable in size and complexity to the DHA EOSS contract.
• Specialized experience: minimum three (3) years in security monitoring, log correlation, vulnerability scanning, and incident response in an enterprise DoD or federal cloud/virtualized environment.
• Clearance eligibility: active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF-86) granting Secret clearance eligibility.
• Access: ability to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation prior to network onboarding.

Salary and location

• Location: Aurora, CO (onsite)
• Salary: USD 160,000 - 185,000 per year (compensation may vary based on candidate skills and experience)

Key technologies and frameworks

• NIST SP 800-137, DoDI 8510.01, DoD Risk Management Framework (RMF)
• Splunk, Splunk Universal Forwarders
• ACAS, Tenable Nessus
• HBSS (Trellix ESS), ePO console
• Burp Suite Professional, RHEL, Windows Server
• Apache, IIS, WebLogic
• CJCSM 6510.01B, DoD 8510.1-M
• DCOPS (Continuous Monitoring and Risk Scoring / CMRS)
• CYOC Issuance Tracker (CIT), eMASS POA&M, CDRL 0012, AOR, ATO

Benefits

• Health/Dental/Vision
• 401(k) match
• Paid Time Off
• STD/LTD/Life Insurance
• Referral Bonuses
• Professional development reimbursement
• Parental leave