Information Security Analyst - SME

Quantum Sky; Quantico (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Quantum Sky is seeking an Information Security Analyst - SME with Red Team experience to support a DoD customer at Quantico. This senior cybersecurity expert will lead RMF assessments, advanced vulnerability analysis, security evaluation, and mission-impact risk assessment for assigned East Coast portfolios.

Responsibilities include conducting complex security control assessments, performing vulnerability analysis and authorized penetration testing, reviewing evidence, and developing feasible

Qualifications

• DoD 8140 IAT Level III or CSSP/DCWF role required.
• CISSP, CEH or government-accepted certs meeting 8140.
• 3+ years DoW network assessment experience.
• 5+ years secure code review experience.
• 2+ years penetration testing.
• 3+ years security evaluations.
• 1+ year DoW expeditionary network environment support.
• Ability to meet privileged-access and background requirements.

Responsibilities

• Lead complex security control assessments and RMF/NIST alignment.
• Perform advanced vulnerability analysis, testing, and evaluation.
• Review findings for sufficiency and mapping before release.
• Develop mitigation strategies, POA&M, and remediation plans.
• Lead assessment planning, ROE development, and final reports.
• Support AO control-effectiveness reporting and risk statements.
• Provide technical leadership and reach-back support to peers.
• Contribute to SOPs, lessons learned, and evidence standards.

Skills

RMF/NIST 800-53A

Penetration testing

Vulnerability analysis

DoD 8140 IAT III

CISSP/CEH

Mentoring

Job description

Quantum Sky is searching for a Information Security Analyst - SME with Red Team experience to support a DoW customer at Quantico. This candidate will serve as a senior cybersecurity subject matter expert for complex RMF Step 6 assessments, advanced vulnerability analysis, security evaluation, and mission-impact risk assessment for assigned East Coast and tactical portfolios.

Responsibilities:

• Lead complex security control assessments and provide expert interpretation of RMF, NIST, DoW, DoN, and USMC cybersecurity requirements.
• Perform advanced vulnerability analysis, security evaluation, secure code review, and authorized penetration testing; assess attack paths, exploitability, exposure, and mission consequences.
• Review assessment evidence and findings for technical sufficiency, reproducibility, and control mapping before release.
• Develop technically feasible mitigation strategies, POA&M recommendations, compensating-control options, and remediation validation approaches.
• Lead or support assessment planning, rules-of-engagement development, technical adjudication, exit briefs, and final report development.
• Support quarterly AO control-effectiveness reporting and translate technical conditions into decision-quality risk statements and recommendations.
• Provide technical leadership, mentoring, and reach-back support to Senior and Journeyman analysts across assigned portfolios.
• Contribute to ConMon SOP updates, lessons learned, evidence standards, and continuous-improvement activities.

Required:

• DoD 8140 /cyberspace workforce qualification: IAT Level III or applicable CSSP/DCWF role.
• Certification: CISSP, CEH, or other Government-accepted certification meeting the required 8140 work role.
• 3+ years conducting DoW network assessments.
• 5+ years performing secure code reviews.
• 2+ years performing penetration testing.
• 3+ years performing security evaluations.
• 1+ year experience supporting DoW expeditionary network environments of similar size and complexity to the customer's Cyberspace Environment
• Ability to meet current DoW, DoN, and USMC privileged-access, background investigation, training, and least-privilege requirements.
• Deep RMF/NIST 800-53A experience; advanced penetration testing/vulnerability analysis; customer's tactical/expeditionary experience; strong AO-level communication.

Required Training / Administrative Readiness:

• Complete and maintain required initial/annual NIPRNET account training, including Cyber Awareness, OPSEC, and Privacy/PII.
• Complete applicable SIPRNET training, including Derivative Classification and local SIPRNET user agreements; NATO Secret briefing if mission-required.
• Complete annual CUI training and local installation/security briefings.
• Maintain required CAC/DBIDS/site-access credentials and comply with DISS visit request requirements.
• Maintain valid passport/visa/driver documentation when required by the duty location or travel assignment.

Performance Expectations:

• Produce complete, accurate, evidence-traceable assessment products in accordance with the SOW, approved QCP, Government formats, and established delivery timelines.
• Escalate critical/high or mission-impacting issues through Quantum Sky program leadership in accordance with the approved governance and escalation process.
• Protect classified information, CUI, Government property, credentials, and assessment data in accordance with contract and local security requirements.
• Operate within the non-personal-services construct; Government personnel provide requirements, priorities, surveillance, and acceptance, while Quantum Sky management directs contractor personnel.

Clearance:

Secret clearance required with the ability to upgrade to a Top Secret