DHA EOSS - Information Security Analyst (Monitoring Information

Responsibilities:

1. Information Security Continuous Monitoring (ISCM) & Threat Surveillance

• 
  Maintain and execute the DHA ECS Continuous Monitoring Plan in compliance with NIST SP 800-137, DoDI 8510.01, and DHA cybersecurity directives.
  
• 
  Continuously monitor the operational security posture of all DHA ECS web applications, relational databases (Oracle), and cloud computing infrastructure hosted within MedCOI AWS GovCloud East to identify unauthorized activity, anomalies, or system degradation.
  
• 
  Routinely monitor, analyze, and maintain the system's security risk posture within the DHA Data Center Operations (DCOPS) Continuous Monitoring and Risk Scoring (CMRS) system, investigating risk score variances and coordinating remediation actions.
  
• 
  Actively track, manage, and respond to cyber directives, operational orders, and taskers logged in the CYOC Issuance Tracker (CIT), ensuring timely status reporting and technical mitigation.
  

2. Cybersecurity Toolset Management & Security Analytics

• 
  Administer, configure, and maintain the operational DHA ECS security monitoring toolset, including Splunk Universal Forwarders, Assured Compliance Assessment Solution (ACAS / Tenable Nessus) scanners/agents, Host Based Security System (HBSS / Trellix ESS) clients, and Burp Suite Professional.
  
• 
  Configure and verify Splunk log forwarders on Red Hat Enterprise Linux (RHEL) and Windows Server instances to aggregate and normalize operating system, web server (Apache, IIS, WebLogic), and database audit logs into DCOPS-hosted Splunk enterprise repositorie.
  
• 
  Author tailored Splunk search queries, correlation rules, dashboards, and automated alerting thresholds to detect abnormal privilege escalation, failed authentications, brute-force activity, or unauthorized configuration modifications.
  
• 
  Plan, schedule, and execute regular credentialed vulnerability scans using ACAS / Tenable Nessus across all virtual machines and database listeners; analyze vulnerability reports, eliminate false positives, and deliver prioritized remediation plans to engineering team.
  
• 
  Oversee HBSS/ESS agent operational health, verifying that Host Intrusion Prevention System (HIPS), Data Loss Prevention (DLP), and VirusScan Enterprise modules remain active, properly policy-assigned, and communicating with the ePO console.
  

3. Cyber Incident Handling & Security Event Analysis

• 
  Serve as the frontline technical lead for security incidents, executing detection, initial triage, containment, eradication, and post-incident analysis in strict accordance with CJCSM 6510.01B ("Cyber Incident Handling Program") and DoD 8510.1-M .
  
• 
  Perform technical event analysis on security alerts generated across network boundaries, host logs, and application layers, establishing root cause and impact on Controlled Unclassified Information (CUI), PII, and Protected Health Information (PHI).
  
• 
  Coordinate incident notifications and operational status reports with the Information System Security Manager (ISSM), Information System Security Officer (ISSO), DHA Global Service Center (GSC), and DCOPS Cyber Operations Center (CYOC).
  
• 
  Author comprehensive After-Action Reports (AARs) and incident post-mortems, identifying preventive controls and incorporating lessons learned into the Security Management and Assessment Plan (CDRL 0012).
  

4. Vulnerability Mitigation & STIG/IAVA Compliance Tracking

• 
  Monitor, analyze, and track Information Assurance Vulnerability Alerts (IAVAs), Bulletins (IAVBs), and Technical Advisories released by USCYBERCOM and DISA, determining applicability across DHA ECS software stacks and operating environments.
  
• 
  Partner with System Administrators, Database Administrators, and Database Security Specialists o verify that patches and STIG configurations are applied within mandated compliance windows.
  
• 
  Maintain and manage the real-time status of security weaknesses in the eMASS Plan of Action and Milestones (POA&M) module; ensure every POA&M entry is updated and reviewed no later than ten (10) calendar days prior to expiration.
  
• 
  Collect and package technical mitigation artifacts (scan deltas, script outputs, system screenshots) to substantiate POA&M closure packages and support Authorization to Operate with Conditions / Risk Acceptance (AOR) requests.
  

5. RMF ATO Support, Governance & Audit Verification

• 
  Conduct mandatory quarterly user account and privileged permission audits across Development, System Test, QA/Pre-Prod, and Production environments to verify compliance with the DHA ECS Segregation of Duties (SOD) matrix and eliminate dormant accounts.
  
• 
  Inspect and maintain the program's whitelisted IP address registry (governing external Extranet, PRISM, SFTP, and data mart connections) to ensure only authorized endpoints can establish communication.
  
• 
  Support the triennial Authority to Operate (ATO) renewal and annual RMF self-assessments by providing continuous monitoring metrics, tool configuration checklists, audit logs, and compliance evidence.
  
• 
  Formulate technical responses and gather evidentiary documentation for cyber data calls, inspections, and audits originating from USCYBERCOM, DISA, DHA J6, and financial audit authorities.
  

Qualifications

Required:

• U.S. Citizenship: Must be a United States Citizen (DHA network account, privileged IT-II access, and eMASS authorization; dual citizenship cannot be accepted).
• DoD 8140.03 Baseline Certification:
  • Mandatory: Valid IAT Level II certification upon hire (e.g., CompTIA Security+ ce, CCNA-Security, CySA+, GICSP, GSEC, or SSCP).
• Highly Desired: Advanced cybersecurity certification under DoD 8140 guidelines (e.g., CySA+, CISSP, CISA, CISM, CASP+ ce, or CSSP Analyst / Incident Responder).
• Education: Bachelor’s degree from an accredited university in Information Assurance, Cybersecurity, Computer Science, Engineering, Information Systems, or a related discipline.
  • Experience Substitution Rule: Fifteen (15) years of documented experience in Information Assurance / IT Cybersecurity may be substituted in lieu of a bachelor’s degree.
• Mandatory PWS Experience Thresholds:
  • Minimum of five (5) years of hands-on experience in Information Assurance / Cybersecurity supporting enterprise applications, databases, and infrastructure of comparable size and complexity to the DHA EOSS contract.
  • Minimum of three (3) years of specialized experience in security monitoring, log correlation, vulnerability scanning, and incident response in an enterprise DoD or federal cloud/virtualized environment.

Desired:

• 
  Direct prior experience supporting the Defense Health Agency (DHA), Military Health System (MHS), DISA DECC, or TRICARE IT systems.
  
• 
  Familiarity with DHA Data Center Operations (DCOPS) service queues, ticketing workflows, and AVHE access architectures.
  
• 
  Experience integrating and monitoring Identity, Credential, and Access Management (ICAM), PKI/CAC authentication, and Single Sign-On (SSO) technologies (OID, OAM).
  
• 
  Scripting capability (Python, Bash, or PowerShell) to automate log collection checks, scan parsing, or compliance reporting.
  
• 
  Experience interfacing with the CYOC, submitting incident reports, and managing entries in CMRS and CIT.
  

Clearance: 

• 
  Active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF-86) granting Secret clearance eligibility.
  
• 
  Must be able to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation prior to network onboarding.
  

Location:

• Aurora, CO