Information Security Analyst
About The Position
Quantum Sky is seeking a highly skilled Information Security Analyst to support the Defense Health Agency (DHA) Enterprise Operations & Support Services (EOSS) contract. The role operates in a secure, cloud-hosted enclave environment at DoD Impact Level 4 and involves monitoring, analyzing, and responding to security events, managing vulnerabilities, and maintaining compliance with DoW cybersecurity requirements under the Risk Management Framework (RMF). The analyst interprets outputs from enterprise cybersecurity tools, including Splunk, endpoint security suites, and the Assured Compliance Assessment Solution (ACAS); analyzes server logs; performs system-level audits; tracks configuration drift against DISA STIG baselines; and reports continuous compliance data directly to the Information System Security Officer (ISSO). The position is located in Aurora, Colorado. Candidates must be U.S. citizens and hold Public Trust or higher. They must have the required DoD 8140 certification for the assigned work role at the time of hire, and be able to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation before network onboarding. An active or favorably adjudicated Tier 3 (T3) / NACLC investigation granting Secret clearance eligibility is also required.
Requirements
- DoD 8140 Cyber Workforce Certification for assigned work role DCWF 541 – Vulnerability Assessment Analyst at time of hire; examples include CompTIA Security+ CE, CompTIA Cloud+, GSEC, CCSP, or SSCP.
- Public Trust or higher and U.S. citizenship.
- Hands-on experience with vulnerability scanning, STIG compliance, and security monitoring tools.
- Working knowledge of NIST SP 800-53, RMF (NIST SP 800-37 / DoDI 8510.01), and DoW security policy.
- At least 3 years of direct experience in Information Assurance, cybersecurity monitoring, and/or vulnerability management.
- Active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF-86) granting Secret clearance eligibility.
- Ability to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation before network onboarding.
Nice To Haves
- Experience with eMASS, ACAS/Tenable, and Splunk.
- Familiarity with Windows Servers, Red Hat Enterprise Linux, Oracle Databases, and/or network security devices.
- Direct experience implementing and auditing DISA STIGs and managing RMF accreditation packages (IATO/ATO).
Responsibilities
- Monitor SIEM and endpoint tools to detect, triage, and escalate security events.
- Analyze vulnerability scans using ACAS/Tenable, and track findings and remediation through POA&Ms.
- Verify DISA STIGs and SRGs using SCAP and STIG Viewer; assess compliance, document deviations, and assist with remediation.
- Review audit logs and system configurations for anomalies, unauthorized changes, and policy violations.
- Support incident response by collecting evidence, documenting timelines, and writing incident reports.
- Track and implement IAVMs, CTOs, TASKORDs, and other directives within required timelines.
- Assist the ISSO with RMF artifacts, continuous monitoring, and annual reviews in eMASS.
- Brief findings and risks to technical staff and leadership in clear, actionable terms.
Benefits
- Health, dental, and vision benefits.
- 401(k) match.
- Paid Time Off.
- Short-term disability, long-term disability, and life insurance.
- Referral bonuses.
- Professional development reimbursement.
- Parental leave.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Education Level
No Education Listed
