DHA-EOSS Technical Writer (Security Specialist Tech Writer)

Quantum Sky•Aurora, CO

1d•$115,000 - $130,000•Onsite

About The Position

Quantum Sky is hiring an experienced Technical Writer to support the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract in Aurora, Colorado. The program provides full lifecycle IT sustainment, cybersecurity, and engineering modernization for the DHA E-Commerce System (ECS), a financial, contracting, and analytical system supporting TRICARE Private Sector Healthcare operations. The ecosystem includes Oracle Federal Financials, the Enterprise Data Warehouse, Global Unison PRISM, and custom applications hosted in MedCOI AWS GovCloud East and managed in Red Hat Enterprise Linux and Windows Server environments. As a Senior Security Specialist Technical Writer, the role leads cybersecurity, information assurance, and compliance documentation across the program. Working with the ISSO, ISSM, enterprise architects, system administrators, and database administrators, the writer authors, maintains, and packages documentation needed to sustain the DHA ECS Authority to Operate under the DoD Risk Management Framework and demonstrate compliance with DISA STIGs, NIST SP 800-53 controls, and DHA security policies.

Requirements

Must be a United States citizen; dual citizenship cannot be accommodated.
Must possess or obtain a DoD 8140.03 certification, such as CompTIA Security+ CE, CCNA Security, or CySA+, within three months of hire.
At least five years of hands-on experience in technical writing and cybersecurity/information assurance documentation supporting enterprise IT programs, databases, and applications of comparable size and complexity to the DHA EOSS contract.
Active or favorably adjudicated Tier 3/NACLC investigation (SF-86), or Tier 2 Public Trust/Non-Critical Sensitive IT-II investigation (SF-85P/MBI).
Must be able to obtain and maintain an active Common Access Card and DHA network account.

Nice To Haves

Current DoD 8140.03 baseline certification in the Information Assurance management or technical domain, such as CompTIA Security+ CE, CGRC/CAP, CySA+, SSCP, or CISSP.
Experience supporting DHA, the Military Health System, TRICARE, or DoD financial/acquisition systems such as Oracle Federal Financials or PRISM.
Direct experience writing and maintaining Disaster Recovery/Continuity of Operations Plans and incident response plans.
Familiarity with AWS GovCloud security architecture, FedRAMP High authorizations, and Cloud Access Point concepts.
Familiarity with Micro Focus Solutions Business Manager, HP Quality Center/ALM, or Git/GitHub for documentation change management.

Responsibilities

Author, review, and maintain RMF documentation required to achieve and preserve DHA ECS ATO and ATO-C.
Manage documentation, configuration, and control evidence uploaded to the DHA ECS DoD eMASS instance.
Draft and update the System Security Plan, documenting how DHA ECS satisfies NIST SP 800-53 controls across 18 control families.
Document technical testing results, security control assessments, and residual risk statements for the Security Assessment Report and Plan.
Compile and maintain system-level risk assessments, categorizations, and mitigation recommendations for the Risk Assessment Report.
Support the ISSO and ISSM in conducting and documenting the annual RMF self-assessment across development, test, QA, and production environments.
Lead research, technical authoring, formatting, and submission of designated Contract Data Requirements Lists (CDRLs).
Develop the Security Management and Assessment Plan, including security control implementation, continuous monitoring, and assessment methodologies.
Document disaster recovery, notification and activation, failover, and reconstitution procedures in the Continuity of Operations Plan in coordination with engineering and hosting teams.
Collaborate with architects on security architecture sections of solution design documentation, including security controls, boundary diagrams, and data flows in AWS GovCloud and AVHE.
Assist the configuration management team with documenting change authorization workflows, baseline control, and traceability.
Track and maintain active POA&Ms and Acceptance of Risk records in eMASS and internal trackers, keeping remediation milestones, resource needs, and completion dates current at least ten calendar days before expiration.
Translate vulnerability scan findings from ACAS/Tenable Nessus, HBSS, Fortify, Burp Suite, and Splunk into clear POA&M narratives and mitigation plans.
Coordinate documentation and archiving of DISA STIGs and checklists for RHEL, Windows Server, Oracle Database, WebLogic, Apache, and IIS.
Help draft technical justifications for STIG exceptions, false positives, and compensating controls.
Author, update, and standardize local information assurance policies, SOPs, and operational guides across PWS-mandated RMF control areas.
Document user access and privileged account, audit and accountability, incident response, media protection, physical and environmental protection, system and communications protection, boundary security, identification and authentication, and PKI procedures.
Document Ports, Protocols, and Services Management requests and registration packets for AWS and AVHE connectivity in accordance with DoDI 8551.01.
Ensure documentation conforms to federal privacy requirements, including DFARS 224.1, DoDD 5400.11, and HIPAA Security and Privacy Rules.
Prepare structured responses, briefings, and evidence packages for security data calls, CYOC directives, and taskers from USCYBERCOM, DISA, and DHA cybersecurity officials.
Assist with documentation packages for DHA Contract Resource Management financial audits, OGC inquiries, and external Defense Security Service or Inspector General inspections.
Participate in weekly security synchronization meetings with the ISSO and ISSM and contribute documentation updates to the monthly Program Management Review.