Information Security Analyst

Cybersecurity Jobs; Aurora (CO); On-site; USD 160,000 - 185,000; Full time

Benefits offered by this job

Health/Dental/Vision

401(k) match

Paid Time Off

STD/LTD/Life Insurance

Referral Bonuses

Professional development reimbursement

Parental leave

Job summary

Quantum Sky seeks a Senior Information Security Analyst to serve as the operational security guardian for the DHA E-Commerce System (ECS) in Aurora, CO. This onsite role emphasizes continuous monitoring, security analytics, incident handling, and RMF/ATO support to maintain security posture.

You will administer the DHA ECS toolset (Splunk, ACAS, Nessus, HBSS, ePO, Burp), coordinate with ISSM/ISSO, and lead incident response activities per DoD directives.

Qualifications

• U.S. citizenship required with DHA access and security clearance eligibility.
• IAT Level II certification required on hire (e.g., Security+, CySA+, GSEC, CCNA-Security, SSCP).
• Bachelor’s degree in Information Assurance/Cybersecurity or 15 years of substitute experience.
• 5+ years hands-on security experience with enterprise apps, databases, and infrastructure.
• 3+ years in security monitoring, log correlation, vulnerability scanning, and incident response.

Responsibilities

• Maintain and execute the DHA ECS Continuous Monitoring Plan per NIST SP 800-137 and RMF directives.
• Continuously monitor DHA ECS web apps, Oracle databases, and MedCOI AWS GovCloud East.
• Monitor CMRS risk posture and coordinate remediation actions.
• Track and respond to directives in the CIT and provide mitigation updates.
• Administer DHA ECS monitoring toolset (Splunk, ACAS/Nessus, HBSS, ePO, Burp).
• Configure Splunk forwarders on RHEL and Windows Server and centralize logs.
• Develop Splunk queries, dashboards, and alerting thresholds for security events.
• Plan and execute credentialed vulnerability scans with ACAS/Nessus; deliver remediation plans.
• Oversee HBSS/ESS health and ePO communications.
• Lead security incident response per CJCSM 6510.01B and DoD 8510.1-M; conduct post-incident analysis.
• Perform technical event analysis across networks, hosts, and apps for CUI/PII/PHI impact.
• Coordinate incident reporting with ISSM/ISSO and DHA GSC/DCOPS.
• Write After-Action Reports with preventive controls for CDLR 0012.
• Monitor IAVAs/IAVBs/TD Advisories from USCYBERCOM/DISA; assess applicability to DHA ECS stacks.
• Verify patches and STIG configurations within compliance windows.
• Maintain DHA program PoA&M status in eMASS and ensure timely reviews.
• Prepare mitigation artifacts for AOR requests.
• Conduct quarterly privilege audits across environments to enforce SOD.
• Maintain whitelisted external connection registry.
• Support triennial ATO renewals and RMF self-assessments with metrics and logs.
• Prepare responses for cyber data calls and audits.

Skills

Security Monitoring

Log Correlation

Incident Response

Vulnerability Scanning

Risk Assessment

Education

Bachelor’s degree in Information Assurance / Cybersecurity / CS

15 years IT security experience (substitute for degree)

Tools

Splunk

ACAS

Tenable Nessus

HBSS

Trellix ESS

ePO

Burp Suite

RHEL

Windows Server

Apache

IIS

WebLogic

Job description

Quantum Sky is seeking a Senior Information Security Analyst to serve as the operational security guardian for the DHA E-Commerce System (ECS). This onsite role in Aurora, CO focuses on continuous monitoring, security analytics, incident handling, vulnerability mitigation and compliance tracking, and supporting Risk Management Framework (RMF) Authority to Operate (ATO) efforts to maintain status.

Core responsibilities

• Maintain and execute the DHA ECS Continuous Monitoring Plan in alignment with NIST SP 800-137, DoDI 8510.01, and DHA cybersecurity directives.
• Continuously monitor the security posture of DHA ECS web applications, relational databases (Oracle), and cloud infrastructure hosted in MedCOI AWS GovCloud East to detect unauthorized activity, anomalies, and system degradation.
• Routinely monitor, analyze, and maintain security risk posture in DHA Data Center Operations (DCOPS) Continuous Monitoring and Risk Scoring (CMRS), investigating risk score variances and coordinating remediation actions.
• Track and respond to cyber directives, operational orders, and taskers recorded in the CYOC Issuance Tracker (CIT), ensuring timely status reporting and technical mitigation.
• Administer, configure, and maintain the DHA ECS security monitoring toolset, including Splunk Universal Forwarders, ACAS / Tenable Nessus scanners and agents, HBSS / Trellix ESS clients, and Burp Suite Professional.
• Configure and verify Splunk log forwarders on RHEL and Windows Server systems to aggregate and normalize operating system, web server (Apache, IIS, WebLogic), and database audit logs into DCOPS-hosted Splunk enterprise repositories.
• Develop tailored Splunk search queries, correlation rules, dashboards, and automated alerting thresholds for events such as privilege escalation, failed authentications, brute-force activity, and unauthorized configuration modifications.
• Plan, schedule, and execute credentialed vulnerability scans using ACAS / Tenable Nessus across virtual machines and database listeners; analyze results, reduce false positives, and deliver prioritized remediation plans to engineering.
• Oversee HBSS/ESS agent operational health, confirming Host Intrusion Prevention System (HIPS), Data Loss Prevention (DLP), and VirusScan Enterprise modules remain active, correctly policy-assigned, and communicating with the ePO console.
• Lead security incident response activities, including detection, initial triage, containment, eradication, and post-incident analysis in accordance with CJCSM 6510.01B ("Cyber Incident Handling Program") and DoD 8510.1-M.
• Perform technical event analysis across network boundaries, host logs, and application layers to establish root cause and impact on CUI, PII, and PHI.
• Coordinate incident notifications and operational status reporting with the ISSM, ISSO, DHA Global Service Center (GSC), and DCOPS CYOC.
• Write comprehensive After-Action Reports (AARs) and incident post-mortems, capturing preventive controls and lessons learned for inclusion in the Security Management and Assessment Plan (CDRL 0012).
• Monitor and track IAVAs, IAVBs, and Technical Advisories from USCYBERCOM and DISA, assessing applicability across DHA ECS software stacks and operating environments.
• Partner with system and database teams to verify patches and STIG configurations are applied within mandated compliance windows.
• Maintain and manage security weakness status in eMASS Plan of Action and Milestones (POA&M), updating entries and ensuring review no later than ten (10) calendar days before expiration.
• Collect and package mitigation artifacts (scan deltas, script outputs, system screenshots) to support POA&M closure and Authorization to Operate with Conditions / Risk Acceptance (AOR) requests.
• Conduct quarterly user account and privileged permission audits across Development, System Test, QA/Pre-Prod, and Production environments to verify compliance with the DHA ECS Segregation of Duties (SOD) matrix and reduce dormant accounts.
• Inspect and maintain the program’s whitelisted IP registry for approved external Extranet, PRISM, SFTP, and data mart connections.
• Support triennial ATO renewal and annual RMF self-assessments by providing continuous monitoring metrics, tool configuration checklists, audit logs, and compliance evidence.
• Prepare technical responses and supporting evidence for cyber data calls, inspections, and audits from USCYBERCOM, DISA, DHA J6, and financial audit authorities.

Required qualifications

• U.S. citizenship: must be a United States Citizen (DHA network account, privileged IT-II access, and eMASS authorization); dual citizenship cannot be accepted.
• IAT Level II certification upon hire (examples provided): CompTIA Security+ ce, CCNA-Security, CySA+, GICSP, GSEC, or SSCP.
• Education: Bachelor’s degree from an accredited university in Information Assurance, Cybersecurity, Computer Science, Engineering, Information Systems, or a related discipline, OR fifteen (15) years of documented experience in Information Assurance / IT Cybersecurity as a substitute.
• Experience: minimum five (5) years hands‑on experience supporting enterprise applications, databases, and infrastructure comparable in size and complexity to the DHA EOSS contract.
• Specialized experience: minimum three (3) years in security monitoring, log correlation, vulnerability scanning, and incident response in an enterprise DoD or federal cloud/virtualized environment.
• Clearance eligibility: active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF‑86) granting Secret clearance eligibility.
• Access: ability to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation prior to network onboarding.

Salary and location

• Location: Aurora, CO (onsite)
• Salary: USD 160,000 - 185,000 per year (compensation may vary based on candidate skills and experience)

Key technologies and frameworks

• NIST SP 800-137, DoDI 8510.01, DoD Risk Management Framework (RMF)
• Splunk, Splunk Universal Forwarders
• ACAS, Tenable Nessus
• HBSS (Trellix ESS), ePO console
• Burp Suite Professional, RHEL, Windows Server
• Apache, IIS, WebLogic
• CJCSM 6510.01B, DoD 8510.1-M
• DCOPS (Continuous Monitoring and Risk Scoring / CMRS)
• CYOC Issuance Tracker (CIT), eMASS POA&M, CDRL 0012, AOR, ATO

Benefits

• Health/Dental/Vision
• 401(k) match
• Paid Time Off
• STD/LTD/Life Insurance
• Referral Bonuses
• Professional development reimbursement
• Parental leave