DHA EOSS - Information Security Analyst (Monitoring Information Assurance/Security Specialist)

Quantum Sky•Aurora, CO

1d•$170,000 - $185,000

About The Position

Quantum Sky is seeking an experienced Senior Information Security Analyst to support the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract. The role serves as the primary operational security monitor for the DHA E-Commerce System (ECS), an enterprise portfolio that includes Oracle Federal Financials, the Enterprise Data Warehouse, contract management systems, and external data exchange nodes hosted in a Medical Community of Interest (MedCOI) AWS GovCloud environment. The analyst leads day-to-day execution of the program’s Information Security Continuous Monitoring strategy under NIST SP 800-137 and DoD Risk Management Framework standards. The position administers security monitoring tools, monitors risk and security events, responds to cyber incidents and operational directives, tracks vulnerabilities and remediation, and provides evidence to support the system’s Authority to Operate. The role also supports audits, account and privilege reviews, security compliance, and RMF governance.

Requirements

Must be a U.S. citizen; dual citizenship cannot be accepted.
Must hold a valid DoD 8140.03 IAT Level II certification upon hire, such as CompTIA Security+ CE, CCNA-Security, CySA+, GICSP, GSEC, or SSCP.
Bachelor’s degree from an accredited university in Information Assurance, Cybersecurity, Computer Science, Engineering, Information Systems, or a related discipline; 15 years of documented Information Assurance/IT Cybersecurity experience may substitute for the degree.
At least five years of hands-on Information Assurance/Cybersecurity experience supporting enterprise applications, databases, and infrastructure of comparable size and complexity.
At least three years of specialized experience in security monitoring, log correlation, vulnerability scanning, and incident response in an enterprise DoD or federal cloud/virtualized environment.
Active or favorably adjudicated Tier 3 (T3)/NACLC investigation (SF-86) granting Secret clearance eligibility.
Must be able to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation before network onboarding.

Nice To Haves

Advanced cybersecurity certification under DoD 8140 guidelines, such as CySA+, CISSP, CISA, CISM, CASP+ CE, or CSSP Analyst/Incident Responder.
Prior experience supporting DHA, the Military Health System, DISA DECC, or TRICARE IT systems.
Familiarity with DCOPS service queues, ticketing workflows, and AVHE access architectures.
Experience integrating and monitoring ICAM, PKI/CAC authentication, and SSO technologies such as OID and OAM.
Scripting capability with Python, Bash, or PowerShell to automate log collection checks, scan parsing, or compliance reporting.
Experience interfacing with CYOC, submitting incident reports, and managing CMRS and CIT entries.

Responsibilities

Maintain and execute the DHA ECS Continuous Monitoring Plan in compliance with NIST SP 800-137, DoDI 8510.01, and DHA cybersecurity directives.
Monitor DHA ECS applications, Oracle databases, and MedCOI AWS GovCloud East infrastructure for unauthorized activity, anomalies, or system degradation.
Monitor the system’s security risk posture in the DCOPS Continuous Monitoring and Risk Scoring (CMRS) system, investigate risk score variances, and coordinate remediation.
Track and respond to cyber directives, operational orders, and taskers in the CYOC Issuance Tracker (CIT), providing timely status and technical mitigation.
Administer and maintain the DHA ECS security monitoring toolset, including Splunk Universal Forwarders, ACAS/Tenable Nessus, HBSS/Trellix ESS, and Burp Suite Professional.
Configure and verify Splunk log forwarders on RHEL and Windows Server systems and aggregate operating system, web server, and database audit logs.
Develop Splunk search queries, correlation rules, dashboards, and alerts to detect suspicious activity and unauthorized changes.
Schedule and conduct credentialed vulnerability scans, analyze reports, identify false positives, and provide prioritized remediation plans.
Monitor HBSS/ESS agent health and verify that security modules remain active, correctly assigned, and communicating with the ePO console.
Lead security incident detection, triage, containment, eradication, and post-incident analysis in accordance with CJCSM 6510.01B and DoD 8510.1-M.
Analyze security events across network, host, and application layers and determine root cause and impact to CUI, PII, and PHI.
Coordinate incident notifications and operational status reports with the ISSM, ISSO, DHA GSC, and DCOPS CYOC.
Prepare incident After-Action Reports and post-mortems, identify preventive controls, and incorporate lessons learned into the Security Management and Assessment Plan (CDRL 0012).
Track IAVAs, IAVBs, and technical advisories, assess applicability, and coordinate patching and STIG compliance with system and database administrators and security specialists.
Maintain security weaknesses in the eMASS POA&M module and ensure entries are updated and reviewed at least ten calendar days before expiration.
Collect and package technical evidence to support POA&M closures and AOR requests.
Conduct quarterly user-account and privileged-permission audits across development, test, QA/pre-production, and production environments, checking segregation of duties and removing dormant accounts.
Maintain the whitelisted IP registry for external Extranet, PRISM, SFTP, and data mart connections.
Support triennial ATO renewals and annual RMF self-assessments by providing monitoring metrics, tool configuration checklists, audit logs, and compliance evidence.
Prepare technical responses and supporting evidence for cyber data calls, inspections, and audits from USCYBERCOM, DISA, DHA J6, and financial audit authorities.