Information Security Analyst - Journeyman

The One 23 Group Inc. is seeking a Journeyman Information Security Analyst to support a technical remediation team focused on the Desktop Common Operating Environment (DCOE). The position is based at Fort Gregg-Adams, VA and plays a key role in turning vulnerability and compliance results into verified fixes for Windows endpoints used in government environments.

Working with desktop and systems stakeholders, you will review scan outputs and government-directed POA&M work orders, implement DISA STIG-aligned technical remediations, and provide objective evidence to support validation and closure activities.

What you will do

• Receive scan findings and government-directed POA&M work orders, analyze technical requirements, and coordinate directly with desktop and systems administrators to implement fixes, remediate non-compliant STIG configurations, resolve IAVMs, and return verification artifacts to government stakeholders.
• Review and analyze vulnerability scan reports (including ACAS/Tenable) and compliance exports from government scanning personnel; prioritize actions using CAT I/II/III, CVSS, and IAVM timelines.
• Receive, review, and execute technical work orders and corrective taskings linked to government-established POA&Ms, implementing the technical changes needed to resolve underlying weaknesses.
• Collaborate with DCOE administrators and systems engineers to remediate vulnerabilities using patch deployment, registry adjustments, Group Policy (GPO) configuration, and operating system baselines.
• Review DISA Security Technical Implementation Guide (STIG) and SCAP compliance findings, implement technical controls on Windows endpoints, and document remediation actions or technical hurdles.
• Gather, format, and provide technical artifacts, test results, and objective evidence to government personnel (ISSM/ISSO) to support validation and POA&M closure.
• Perform local verification to confirm patches, GPO modifications, and hardening scripts applied correctly before requesting government re-scans.
• Track Information Assurance Vulnerability Management (IAVM) notices against assigned remediation work orders, ensuring implementation within required operational windows.
• Maintain accurate, up-to-date documentation on remediation activities and status updates in enterprise ticketing systems such as ServiceNow, BMC Remedy, or Ivanti.
• Coordinate with endpoint administrators to ensure McAfee/Trellix Endpoint Security Solutions (ESS/HBSS) agents are healthy and updated on target endpoints throughout remediation cycles.

Required qualifications

• Ability to read, interpret, and prioritize vulnerability scan reports generated by ACAS (Tenable Nessus) and SCAP/SCC tools.
• Experience executing remediation work orders and tracking remediation tasks tied to government POA&Ms.
• Practical technical experience remediating cybersecurity findings in a Windows enterprise environment, including GPO modifications, registry updates, script execution, and patch verification.
• Strong working knowledge of DISA STIGs, SRGs, and associated checklist formats (.ckl).
• Familiarity with DoD cybersecurity concepts, the DoD IAVM program, vulnerability categorization (CAT I, II, III), and CVSS scoring.
• Experience compiling objective remediation evidence and artifacts (for example: command outputs, screenshots, and configuration logs) for government validation.
• Working knowledge of enterprise ITSM/ticketing systems such as ServiceNow, BMC Remedy, or Ivanti.
• Basic understanding of Public Key Infrastructure (PKI) and endpoint protection tools (ESS/HBSS).
• Strong written and verbal communication skills for coordination with system administrators, engineering teams, and government leads.
• Bachelor’s degree plus Five (5) years of relevant experience.
• DoD 8140 Foundational Certification (Required): active certification, including one of the listed options (CEH(P), RCCE Level 1, Cloud+, CPTE, FITSP-A, GCED, GCIH, GCSA, GICSP, GSEC, PenTest+, or Security+).
• Computing Environment Training (Required or obtainable post-hire): ACAS/EMASS.
• Computing Environment Training (Required or obtainable post-hire): ITIL v4 Foundation (preferred/obtainable post-hire).
• Clearance requirement: Active DoD Secret clearance (or ability to obtain and maintain an interim Secret clearance prior to start).

Technology areas

• ACAS, Tenable, Tenable Nessus, SCAP, SCC
• DISA STIG, SCAP compliance, checklist formats (.ckl)
• GPO, Group Policy, Windows endpoints, SRGs
• DoD IAVM program, CVSS
• ITSM/ticketing systems: ServiceNow, BMC Remedy, Ivanti
• McAfee, Trellix Endpoint Security Solutions (ESS/HBSS), PKI
• ITIL v4