Job description

Quantum Sky is searching for an experienced Technical Writer (Security Specialist Tech Writer) to support the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract in Aurora, Colorado. Under this contract, our team provides full lifecycle IT sustainment, cybersecurity, and engineering modernization for the DHA E-Commerce System (ECS)—the mission-critical financial, contracting, and analytical engine supporting the Department of Defense's TRICARE Private Sector Healthcare operations. The DHA ECS ecosystem encompasses Oracle Federal Financials (OFF), the Enterprise Data Warehouse (EDW), Global Unison PRISM, and custom web applications hosted in MedCOI Amazon Web Services (AWS) GovCloud East and managed via Red Hat Enterprise Linux (RHEL) and Windows Server environments. As a Senior Security Specialist Technical Writer, you will serve as the lead author and custodian of all cybersecurity, information assurance, and compliance documentation across the program. Working in close collaboration with the Information System Security Officer (ISSO), Information System Security Manager (ISSM), Enterprise Architects, System Administrators, and Database Administrators, you will author, maintain, and package authoritative artifacts required to sustain the DHA ECS Authority to Operate (ATO) under the DoD Risk Management Framework (RMF) and ensure full compliance with DISA STIGs, NIST SP 800-53 controls, and DHA security policies. Responsibilities: 1. RMF Artifact & ATO Package Documentation • Author, review, and continuously maintain the comprehensive body of Risk Management Framework (RMF) documentation required to achieve and preserve the DHA ECS triennial Authority to Operate (ATO) and Authority to Operate with Conditions (ATO-C). • Directly manage the documentation, configuration, and control evidence uploaded to the DHA ECS instance of the DoD Enterprise Mission Assurance Support Service (eMASS): • System Security Plan (SSP): Draft and update detailed narrative descriptions of how DHA ECS satisfies all NIST SP 800-53 security controls across all 18 control families. • Security Assessment Report (SAR) & Plan: Document technical testing results, security control assessments, and residual risk statements. • Risk Assessment Report (RAR): Compile and maintain formal system-level risk assessments, categorizations, and mitigation recommendations • Support the ISSO and ISSM in conducting and documenting the annual RMF self-assessment (due on the anniversary of the ATO) to evaluate and validate security posture across all Dev, Test, QA, and Production environments. 2. Contract Deliverables (CDRLs) Leadership (PWS Part 7, Attachment 1) • Lead the research, technical authoring, formatting, and submission of designated Contract Data Requirements Lists (CDRLs): • Security Management and Assessment Plan Develop the formal strategy and documentation defining security control implementations, continuous monitoring processes, and security assessment methodologies. • Continuity of Operations (COOP) Plan: In coordination with engineering and hosting teams, document disaster recovery, notification/activation, failover to alternate sites, and reconstitution procedures to achieve 99.90% system availability. • Solution Design Documentation - Security Architecture Sections: Collaborate with architects to document security controls, boundary diagrams, and data flows within AWS GovCloud and AVHE. • Configuration Management (CM) Compliance Plan: Assist the CM team in documenting change authorization workflows, baseline control, and traceability. 3. Vulnerability, POA&M, and STIG Documentation • Track, document, and maintain all active Plans of Action and Milestones (POA&Ms) and Acceptance of Risk (AOR) records in eMASS and internal trackers: • Ensure all POA&M remediation milestones, resource requirements, and completion dates are accurately updated no later than ten (10) calendar days before expiration. • Translate technical vulnerability scan findings (from ACAS/Tenable Nessus, HBSS, Fortify, Burp Suite, Splunk) into actionable, clear POA&M narrative descriptions and mitigation plans. • Coordinate with System Administrators, DBAs, and Developers to document and archive DISA Security Technical Implementation Guides (STIGs) and checklists (e.g., RHEL, Windows Server, Oracle Database, WebLogic, Apache, IIS). • Assist in drafting technical justification packages for STIG exceptions, False Positives, and compensating controls. 4. Enterprise Security Policies, SOPs, and Compliance Guidance • Author, update, and standardize DHA ECS local Information Assurance Policies, Standard Operating Procedures (SOPs), and operational guides across the twenty (20) PWS-mandated RMF control areas: • User Access & Privileged Account SOPs • Audit and Accountability Procedures • Incident Response and Cyber Incident Handling SOPs (in compliance with CJCSM 6510.01B) • Media Protection, Physical & Environmental Protection Policies • System and Communications Protection (SC) & Boundary Security SOPs • Identification and Authentication (IA) / PKI Enabling Procedures • Document Ports, Protocols, and Services Management (PPSM) requests and registration packets for AWS and AVHE connectivity in accordance with DoDI 8551.01. • Ensure all documentation conforms to federal data privacy mandates, specifically DFARS 224.1, DoDD 5400.11 (DoD Privacy Program), and HIPAA Security/Privacy Rules (DoDM 6025.18 / DoDI 6025.18). 5. Audit Support, Taskers, and Stakeholder Reporting • Prepare structured responses, briefings, and evidence packages for security data calls, Cyber Operations Center (CYOC) directives, and Taskers issued by USCYBERCOM, DISA, and DHA Cybersecurity Officials. • Assist in compiling documentation packages for DHA Contract Resource Management (CRM) financial audits, Office of General Counsel (OGC) inquiries, and external Defense Security Service / IG inspections. • Participate in weekly security synchronization meetings with the ISSO/ISSM and contribute documentation updates to the monthly Program Management Review (PMR). Required: • U.S. Citizenship: Must be a United States Citizen (mandatory for DHA network authorization, access to eMASS, handling of Controlled Unclassified Information [CUI], and facility clearance; dual citizenship cannot be accommodated). • Cybersecurity Certification: Must possess or obtain a DoD 8140.03 certification (e.g., CompTIA Security+ CE, CCNA Security, CySA+) within three (3) months of hire. • Mandatory PWS Experience: • Minimum of five (5) years of hands-on experience in Technical Writing and Cybersecurity / Information Assurance Documentation supporting enterprise IT programs, databases, and applications of the size and complexity of the DHA EOSS contract. Desired: • Holding a current DoD 8140.03 baseline certification in the Information Assurance management or technical domain (e.g., CompTIA Security+ ce, CGRC / CAP, CySA+, SSCP, or CISSP). • Prior experience supporting the Defense Health Agency (DHA), Military Health System (MHS), TRICARE, or DoD financial/acquisition systems (e.g., Oracle Federal Financials, PRISM). • Direct experience writing and maintaining Disaster Recovery / Continuity of Operations Plans (COOP) and incident response plans. • Familiarity with AWS GovCloud security architecture, FedRAMP High authorizations, and Cloud Access Point (CAP) concepts. • Familiarity with Micro Focus Solutions Business Manager (SBM), HP Quality Center (QC) / ALM, or Git/GitHub for documentation change management. Clearance: • Active or favorably adjudicated Tier 3 (T3) / NACLC investigation (SF-86), or Tier 2 (T2) Public Trust / Non-Critical Sensitive IT-II investigation (SF-85P / MBI). • Must be able to obtain and maintain an active Common Access Card (CAC) and DHA network account. Location: • Auroa, CO Compensation: • Compensation is unique to each candidate and relative to the skills and experience they bring to the position. The salary range for this position is typically between $105,000-$135,000. This does not guarantee a specific salary as compensation is based upon multiple factors such as education, experience, certifications, and other requirements, and may fall outside of the above-stated range. Benefits: • Highlights of our benefits include Health/Dental/Vision, 401(k) match, Paid Time Off, STD/LTD/Life Insurance, Referral Bonuses, professional development reimbursement, and parental leave. The world the mission operates in is going post-quantum, contested, and machine-speed. Quantum Sky engineers the advantage across cyber, networks, software, and quantum because the mission demands dominance, not parity. We don't follow the map. We draw it. At Quantum Sky, we believe that success starts with our people. We foster a collaborative, innovative, and mission-driven environment where every team member plays a critical role in shaping the future of technology. Are you ready to join #TeamQuantumSky? Quantum Sky Engineering LLC is an Equal Opportunity Employer; all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, [sexual orientation, gender identity,] national origin, disability, status as a protected veteran, or any characteristic protected by applicable law.

Requirements

Must-haves

Quantum Sky is searching for an experienced Technical Writer (Security Specialist Tech Writer) to support the Defense Health Agency (DHA) E-Commerce Operational Systems Support (EOSS) contract in Aurora, Colorado.
RMF Artifact & ATO Package Documentation
Directly manage the documentation, configuration, and control evidence uploaded to the DHA ECS instance of the DoD Enterprise Mission Assurance Support Service (eMASS):
System Security Plan (SSP): Draft and update detailed narrative descriptions of how DHA ECS satisfies all NIST SP 800-53 security controls across all 18 control families.
Security Assessment Report (SAR) & Plan: Document technical testing results, security control assessments, and residual risk statements.
Risk Assessment Report (RAR): Compile and maintain formal system-level risk assessments, categorizations, and mitigation recommendations
Support the ISSO and ISSM in conducting and documenting the annual RMF self-assessment (due on the anniversary of the ATO) to evaluate and validate security posture across all Dev, Test, QA, and Production environments.
Contract Deliverables (CDRLs) Leadership (PWS Part 7, Attachment 1)
Lead the research, technical authoring, formatting, and submission of designated Contract Data Requirements Lists (CDRLs):
Security Management and Assessment Plan Develop the formal strategy and documentation defining security control implementations, continuous monitoring processes, and security assessment methodologies.
Solution Design Documentation - Security Architecture Sections: Collaborate with architects to document security controls, boundary diagrams, and data flows within AWS GovCloud and AVHE.
Configuration Management (CM) Compliance Plan: Assist the CM team in documenting change authorization workflows, baseline control, and traceability.
Vulnerability, POA&M, and STIG Documentation
Track, document, and maintain all active Plans of Action and Milestones (POA&Ms) and Acceptance of Risk (AOR) records in eMASS and internal trackers:
Ensure all POA&M remediation milestones, resource requirements, and completion dates are accurately updated no later than ten (10) calendar days before expiration.
Translate technical vulnerability scan findings (from ACAS/Tenable Nessus, HBSS, Fortify, Burp Suite, Splunk) into actionable, clear POA&M narrative descriptions and mitigation plans.
Assist in drafting technical justification packages for STIG exceptions, False Positives, and compensating controls.
Enterprise Security Policies, SOPs, and Compliance Guidance
Author, update, and standardize DHA ECS local Information Assurance Policies, Standard Operating Procedures (SOPs), and operational guides across the twenty (20) PWS-mandated RMF control areas:

Nice-to-haves

Holding a current DoD 8140.03 baseline certification in the Information Assurance management or technical domain (e.g., CompTIA Security+ ce, CGRC / CAP, CySA+, SSCP, or CISSP).
Prior experience supporting the Defense Health Agency (DHA), Military Health System (MHS), TRICARE, or DoD financial/acquisition systems (e.g., Oracle Federal Financials, PRISM).
Direct experience writing and maintaining Disaster Recovery / Continuity of Operations Plans (COOP) and incident response plans.
Familiarity with AWS GovCloud security architecture, FedRAMP High authorizations, and Cloud Access Point (CAP) concepts.
Familiarity with Micro Focus Solutions Business Manager (SBM), HP Quality Center (QC) / ALM, or Git/GitHub for documentation change management.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aws

Platform: icims
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off

Parental Leave

Professional Development