Information Security Analyst

We are seeking an Information Security Analyst - Journeyman to support a cybersecurity and technical remediation team within a Department of Defense environment.

This role is focused on identifying, tracking, and remediating cybersecurity vulnerabilities across Windows enterprise systems. The analyst will review vulnerability scan findings and POA&M remediation tasks, work directly with desktop and systems administrators to implement corrective actions, address STIG and IAVM findings, and provide supporting documentation and evidence for validation and closure. Key Responsibilities

• Review and analyze vulnerability scan results from ACAS/Tenable Nessus, SCAP, and related compliance tools.
• Prioritize vulnerabilities based on CAT I/II/III classifications, CVSS scores, and IAVM timelines.
• Execute technical remediation tasks associated with Plans of Action and Milestones (POA&Ms).
• Work with desktop administrators and systems engineers to remediate vulnerabilities through:
• Windows patching
• Registry modifications
• Group Policy (GPO) changes
• Security baseline configuration
• Script execution and verification
• Review and remediate DISA STIG and SCAP compliance findings.
• Troubleshoot non-compliant Windows endpoint configurations and implement required security controls.
• Collect remediation evidence such as command outputs, screenshots, configuration logs, and test results.
• Perform pre-scan validation to confirm patches, GPO changes, and hardening configurations have been successfully applied.
• Track Information Assurance Vulnerability Management (IAVM) notices and assigned remediation activities.
• Maintain accurate remediation status and documentation within enterprise ticketing platforms such as ServiceNow, BMC Remedy, or Ivanti.
• Coordinate with endpoint administrators to support the health and maintenance of McAfee/Trellix ESS/HBSS security agents.

• Experience reviewing and interpreting vulnerability scans from ACAS/Tenable Nessus and SCAP/SCC.
• Hands-on experience remediating cybersecurity vulnerabilities within a Windows enterprise environment.
• Experience with Group Policy, Windows Registry changes, patching, security baselines, and script execution.
• Working knowledge of DISA STIGs, SRGs, and .ckl checklist formats.
• Understanding of DoD vulnerability management concepts, including:
• IAVM
• CAT I, II, and III vulnerabilities
• CVSS scoring
• POA&M remediation
• Experience documenting remediation activities and providing technical evidence for validation.
• Familiarity with enterprise ITSM platforms such as ServiceNow, BMC Remedy, or Ivanti.
• Basic understanding of Public Key Infrastructure (PKI) and endpoint security tools such as ESS/HBSS.
• Strong written and verbal communication skills with the ability to coordinate effectively with technical teams and cybersecurity stakeholders., * Bachelor’s degree plus 3 years of relevant experience.
• Must hold an active DoD 8140 foundational-level qualifying certification, such as:
• Security+
• CySA+, * Experience or training with ACAS and/or eMASS preferred.
• ITIL 4 Foundation certification is preferred or may be obtained after hire.
• Must possess an active DoD Secret clearance or be eligible to obtain and maintain an interim Secret clearance prior to starting.

Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico.

Everforth Apex uses a virtual recruiter as part of the application process. Click for more details. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Everforth Apex and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at, UnitedHealthcare creates and publishes the Transparency in Coverage Machine-Readable Files on behalf of Everforth Apex Systems.