Information Security Analyst

Quantum Sky is seeking a Senior Information Security Analyst to serve as the operational security guardian for the DHA E-Commerce System (ECS). This onsite role in Aurora, CO focuses on continuous monitoring, security analytics, incident handling, vulnerability mitigation and compliance tracking, and supporting Risk Management Framework (RMF) Authority to Operate (ATO) efforts to maintain status.

• Maintain and execute the DHA ECS Continuous Monitoring Plan in alignment with NIST SP 800-137
  , DoDI 8510.01
  , and DHA cybersecurity directives
  .
• Continuously monitor the security posture of DHA ECS web applications
  , relational databases (Oracle), and cloud infrastructure hosted in MedCOI AWS Gov Cloud East to detect unauthorized activity, anomalies, and system degradation.
• Routinely monitor, analyze, and maintain security risk posture in DHA Data Center Operations (DCOPS) Continuous Monitoring and Risk Scoring (CMRS), investigating risk score variances and coordinating remediation actions.
• Track and respond to cyber directives, operational orders, and taskers recorded in the CYOC Issuance Tracker (CIT), ensuring timely status reporting and technical mitigation.
• Administer, configure, and maintain the DHA ECS security monitoring toolset, including Splunk Universal Forwarders
  , ACAS / Tenable Nessus scanners and agents,
  HBSS / Trellix ESS clients, and Burp Suite Professional
  .
• Configure and verify Splunk log forwarders on RHEL and Windows Server systems to aggregate and normalize operating system, web server (Apache, IIS, Web Logic), and database audit logs into DCOPS-hosted Splunk enterprise repositories
  .
• Develop tailored Splunk search queries, correlation rules, dashboards, and automated alerting thresholds for events such as privilege escalation, failed authentications, brute-force activity, and unauthorized configuration modifications.
• Plan, schedule, and execute credentialed vulnerability scans using ACAS / Tenable Nessus across virtual machines and database listeners; analyze results, reduce false positives, and deliver prioritized remediation plans to engineering.
• Oversee HBSS/ESS agent operational health
  , confirming Host Intrusion Prevention System (HIPS), Data Loss Prevention (DLP), and Virus Scan Enterprise modules remain active, correctly policy-assigned, and communicating with the ePO console
  .
• Lead security incident response activities, including detection, initial triage, containment, eradication, and post-incident analysis in accordance with CJCSM 6510.01B ("Cyber Incident Handling Program") and DoD 8510.1-M.
• Perform technical event analysis across network boundaries, host logs, and application layers to establish root cause and impact on CUI, PII, and PHI
  .
• Coordinate incident notifications and operational status reporting with the ISSM
  , ISSO
  , DHA Global Service Center (GSC), and DCOPS CYOC
  .
• Write comprehensive After-Action Reports (AARs) and incident post-mortems, capturing preventive controls and lessons learned for inclusion in the Security Management and Assessment Plan (CDRL 0012).
• Monitor and track IAVAs, IAVBs, and Technical Advisories from USCYBERCOM and DISA
  , assessing applicability across DHA ECS software stacks and operating environments.
• Partner with system and database teams to verify patches and STIG configurations are applied within mandated compliance windows.
• Maintain and manage security weakness status in eMASS Plan of Action and Milestones (POA&M), updating entries and ensuring review no later than ten (10) calendar days before expiration.
• Collect and package mitigation artifacts (scan deltas, script outputs, system screenshots) to support POA&M closure and Authorization to Operate with Conditions / Risk Acceptance (AOR) requests.
• Conduct quarterly user…