Quantum Sky is searching for a Senior-Level Information Security Analyst 273 (OS Security & Database Management Security Specialist) to join our mission-critical engineering team supporting the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract in Aurora, Colorado.

Under this contract, our team provides comprehensive IT sustainment, cybersecurity, and modernization for the DHA E-Commerce System (ECS)—the enterprise platform managing the Department of Defense’s TRICARE Private Sector Healthcare program. DHA ECS encompasses Oracle Federal Financials (OFF), the Enterprise Data Warehouse (EDW), Global Unison PRISM, and specialized contract management systems hosted in MedCOI Amazon Web Services (AWS) GovCloud East and accessed via the DHA Application Virtualization Hosting Environment (AVHE).

In this critical cybersecurity role, you will bridge the gap between technical operations and cyber governance. You will serve as the dedicated security specialist embedded alongside our Operating System Administrators and Database Administrators (DBAs), ensuring that all Red Hat Enterprise Linux (RHEL), Microsoft Windows Server, and Oracle database platforms are rigorously hardened against emerging threats. You will execute automated and manual vulnerability scans, enforce DISA Security Technical Implementation Guides (STIGs), coordinate IAVA patch management, remediate security findings, and author technical justification artifacts supporting the DHA ECS triennial Authority to Operate (ATO) under the DoD Risk Management Framework (RMF).

Responsibilities:

1. Database Security & Hardening

• Serve as the dedicated Database Security Specialist embedded with the DBA team, ensuring that security policies, access controls, and patch routines are uniformly applied across all DHA ECS Oracle database instances (OFF, EDW, PRISM, MTR/PAT, ECCP) across all operating environments (Development, System Test, QA/Pre-Prod, Benchmark, and Production).

• Apply, validate, and audit DISA Database STIGs and DoD RMF Control Correlation Identifiers (CCIs) for Oracle Database 12c/19c, Oracle Internet Directory (OID), Oracle Access Manager (OAM), and Cloud Control.

• Audit database access permissions, roles, privileges, and profile parameters to prevent privilege escalation and enforce least privilege in accordance with the DHA ECS Segregation of Duties (SOD) matrix.

• Monitor and evaluate database audit logs, Unified Auditing trails, and database connection events; coordinate with the ISSO to ensure audit logs are continuously forwarded to Splunk for continuous monitoring and correlation.

• Support DBAs during bi-weekly maintenance windows and software upgrades to verify that database security configurations remain intact post-patching.

2. Operating System Security & Compliance

• Direct and enforce OS-level security hardening across all DHA ECS virtual servers executing Red Hat Enterprise Linux (RHEL 7/8/9) and Microsoft Windows Server (2016/2019/2022) within MedCOI AWS GovCloud East.

• Apply, automate, and document DISA Operating System STIGs, Security Requirements Guides (SRGs), and Group Policy Objects (GPOs) across AWS AMIs and active server instances.

• Collaborate with Systems Administrators to engineer and maintain hardened, application-compliant DHA ECS Amazon Machine Images (AMIs) and templates for DCOPS hosting deployment.

• Oversee Host Based Security System (HBSS) / Endpoint Security Standard (ESS) agent operations, ensuring proper policy enforcement, antivirus definitions, and Host Intrusion Prevention System (HIPS) module compliance across all virtual endpoints.

3. Vulnerability Management, Scanning & Remediation

• Conduct and analyze regular vulnerability scans across all OS environments and databases utilizing government-provided tools: Assured Compliance Assessment Solution (ACAS / Tenable Nessus), HBSS, Splunk, and Burp Suite.

• Evaluate Information Assurance Vulnerability Alerts (IAVAs), Bulletins (IAVBs), and Cyber Operations Center (CYOC) directives (CIT); collaborate with System Administrators and DBAs to implement patches, script fixes, or configuration remediations within mandated DoD timelines.

• Support quarterly user and permission audits across Dev, Test, QA, and Production environments to verify compliance with DHA access control and account lifecycle policies.

• Perform technical root-cause analyses on security vulnerabilities identified by ACAS or DCOPS host management, establishing whether findings are true vulnerabilities, false positives, or mitigated by compensating network controls.

4. Risk Management Framework (RMF) & eMASS Governance

• Directly assist the ISSO and ISSM with sustaining the DHA ECS Authority to Operate (ATO) and maintaining system security artifacts in accordance with DoDI 8510.01 and NIST SP 800-53.

• Maintain, update, and manage Plans of Action and Milestones (POA&Ms) and Acceptance of Risk (AOR) packages in the DoD Enterprise Mission Assurance Support Service (eMASS):

  • Ensure all open OS and database POA&Ms are reviewed, validated, and updated no later than ten (10) calendar days prior to expiration

  • Draft comprehensive remediation milestone narratives and assemble evidentiary test artifacts for POA&M closure.

• Participate actively in the preparation and execution of the annual RMF self-assessment and technical security audits required on the anniversary of the ATO.

• Support the Technical Writer nd ISSO in drafting, reviewing, and updating the Security Management and Assessment Plan and System Security Plan (SSP) control responses.

5. Architecture, Modernization & Identity Security

• Participate as the cybersecurity stakeholder in Configuration Working Group (CWG) and Configuration Management Board (CMB) reviews, ensuring no software, OS, or schema modification is deployed without prior security validation.
• Support the integration and configuration of the DoD Enterprise Identity, Credential, and Access Management (ICAM) solution into OFF, WebLogic, OID, and OAM, ensuring compliant authentication/authorization for Person Entities (PE) and Non-Person Entities (NPE).
• Ensure strict adherence to DoD Public Key Infrastructure (PKI) and Common Access Card (CAC) / PIV authentication standards across all web interfaces, database listener endpoints, and management ports.
• Participate in the annual DHA ECS Continuity of Operations (COOP) and Disaster Recovery exercise, verifying that OS and database security postures and STIG configurations remain identical upon failover to the COOP platform
•  

Required:

• U.S. Citizenship: Must be a United States Citizen (mandatory for DoD Secret clearance, DHA network account, privileged IT-II access, and eMASS authorization; dual citizenship cannot be accepted).
• DoD 8140.03 / 8570.01-M Baseline Certification:
  • Mandatory: Valid IAT Level II certification upon hire (e.g., CompTIA Security+ ce, CCNA-Security, CySA+, GICSP, GSEC, or SSCP).
• Highly Desired: Advanced cybersecurity certification under DoD 8140 guidelines (e.g., CISSP, CISA, CISM, CASP+ ce, or CSSP Auditor/Infrastructure).
• Education: Bachelor’s degree from an accredited university in Information Assurance, Cybersecurity, Computer Science, Computer Engineering, Information Systems, or a related discipline.
  • Experience Substitution Rule: Fifteen (15) years of documented experience in IT cybersecurity, OS administration, or database security may be substituted in lieu of a bachelor’s degree.
• Mandatory PWS Experience Thresholds:
  • Minimum of five (5) years of hands-on experience in Information Assurance / Cybersecurity supporting enterprise applications, databases, and operating systems of comparable size and complexity to the DHA EOSS contract.
  • Specific Security DBA skills with a minimum of five (5) years of experience with database IA (specifically Oracle), including the application of DoD STIGs, RMF CCIs, and IA checklists.

Required Technical Proficiencies & Core Competencies:

• Proven track record of applying and remediating DISA STIGs across Oracle Databases (12c/19c), Red Hat Enterprise Linux (RHEL 7/8/9), and Microsoft Windows Server.

• Hands-on proficiency using the Assured Compliance Assessment Solution (ACAS / Tenable Nessus) for vulnerability scanning, credentialed audits, and scan result parsing.

• Working knowledge of Host Based Security System (HBSS) / Trellix Endpoint Security (ENS), including agent deployment, policy compliance, and log analysis.

• Demonstrated experience with the DoD Risk Management Framework (RMF) (NIST SP 800-37, NIST SP 800-53 Rev 4/5) and hands-on utilization of eMASS for POA&M and artifact tracking.

• Solid understanding of UNIX/Linux and Windows system security parameters, kernel security configurations, SSH key management, PAM modules, and audit daemon (auditd) logging.

• Strong understanding of Oracle database security features: Transparent Data Encryption (TDE), Database Vault, Virtual Private Database (VPD), Unified Auditing, and secure listener configurations.

• Familiarity with AWS GovCloud hosting architectures, security groups, IAM policies, and VPC routing within a DoD MedCOI environment.

Desired:

• Direct prior experience supporting the Defense Health Agency (DHA), Military Health System (MHS), DISA DECC, or TRICARE systems.

• Experience with Splunk enterprise log management, dashboard creation, and query development for security event correlation.

• Experience supporting DoD ICAM, CAC/PKI integration, and SAML/OAuth token exchanges across Oracle Fusion Middleware (WebLogic, OAM, OID).

• Background in scripting (Bash, PowerShell, Python, or SQL) to automate STIG checklist evaluations and repetitive compliance auditing tasks.

• Prior experience preparing for or participating in formal government Cyber Security Inspections (CCRI, DHA RMF Site Visits, or Financial Audit SOC-1 reviews).

Clearance: 

• Active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF-86) granting Secret clearance eligibility.

• Must be able to obtain and maintain an active Common Access Card (CAC) and DHA IT-II privileged access designation prior to network onboarding.

Location:

• Aurora, CO

Compensation:

• Compensation is unique to each candidate and relative to the skills and experience they bring to the position. The salary range for this position is typically between $165,000-$180,000. This does not guarantee a specific salary as compensation is based upon multiple factors such as education, experience, certifications, and other requirements, and may fall outside of the above-stated range.

Benefits: