DHA-EOSS Technical Writer; Security Specialist Tech Writer

Quantum Sky is searching for an experienced Technical Writer (Security Specialist Tech Writer) to support the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract in Aurora, Colorado.

Under this contract, our team provides full lifecycle IT sustainment, cybersecurity, and engineering modernization for the DHA E-Commerce System (ECS)—the mission-critical financial, contracting, and analytical engine supporting the Department of Defense's TRICARE Private Sector Healthcare operations. The DHA ECS ecosystem encompasses Oracle Federal Financials (OFF), the Enterprise Data Warehouse (EDW), Global Unison PRISM, and custom web applications hosted in MedCOI Amazon Web Services (AWS) Gov Cloud East and managed via Red Hat Enterprise Linux (RHEL) and Windows Server environments.

As a Senior Security Specialist Technical Writer, you will serve as the lead author and custodian of all cybersecurity, information assurance, and compliance documentation across the program. Working in close collaboration with the Information System Security Officer (ISSO), Information System Security Manager (ISSM), Enterprise Architects, System Administrators, and Database Administrators, you will author, maintain, and package authoritative artifacts required to sustain the DHA ECS Authority to Operate (ATO) under the DoD Risk Management Framework (RMF) and ensure full compliance with DISA STIGs, NIST SP 800-53 controls, and DHA security policies.

Responsibilities:

• Author, review, and continuously maintain the comprehensive body of Risk Management Framework (RMF) documentation required to achieve and preserve the DHA ECS triennial Authority to Operate (ATO) and Authority to Operate with Conditions (ATO-C).

• Directly manage the documentation, configuration, and control evidence uploaded to the DHA ECS instance of the DoD Enterprise Mission Assurance Support Service (eMASS):

  • System Security Plan (SSP): Draft and update detailed narrative descriptions of how DHA ECS satisfies all NIST SP 800-53 security controls across all 18 control families.

  • Security Assessment Report (SAR) & Plan: Document technical testing results, security control assessments, and residual risk statements.

  • Risk Assessment Report (RAR): Compile and maintain formal system-level risk assessments, categorizations, and mitigation recommendations

• Support the ISSO and ISSM in conducting and documenting the annual RMF self-assessment (due on the anniversary of the ATO) to evaluate and validate security posture across all Dev, Test, QA, and Production environments.

• Lead the research, technical authoring, formatting, and submission of designated Contract Data Requirements Lists (CDRLs):

  • Security Management and Assessment Plan Develop the formal strategy and documentation defining security control implementations, continuous monitoring processes, and security assessment methodologies.

  • Continuity of Operations (COOP) Plan: In coordination with engineering and hosting teams, document disaster recovery, notification/activation, failover to alternate sites, and reconstitution procedures to achieve 99.90% system availability.

  • Solution Design Documentation - Security Architecture Sections: Collaborate with architects to document security controls, boundary diagrams, and data flows within AWS Gov Cloud and AVHE.

  • Configuration Management (CM) Compliance Plan: Assist the CM team in documenting change authorization workflows, baseline control, and traceability.

• Track, document, and maintain all active Plans of Action and Milestones (POA&M) and Acceptance of Risk (AOR) records in eMASS…