Position SummaryThis position supports Task 3 - Cybersecurity Operations Support, which delivers Defensive Cyberspace Operations - Internal Defensive Measures (DCO-IDM) across the DoDIN-Army-NG area of responsibility. The role executes authenticated and unauthenticated ACAS scans, analyzes vulnerability findings, validates scan coverage and credential integrity, coordinates remediation with system owners, performs rescans, updates POA&Ms, and contributes to operational reporting aligned with STIGs, IAVMs, RMF requirements, and ARNG cybersecurity directives. Working as part of the broader SOC and cybersecurity operations team, this position helps sustain continuous monitoring, vulnerability management, and enterprise cyber defense activities.
Please Note: This position is contingent upon contract award.This role directly supports ARNG's mission to deliver secure DoDIN services to more than 120,000 users and approximately 141,000 endpoints across roughly 2,800 sites in 54 states and territories, spanning both classified and unclassified network environments. ENOCS supports Title 10 and Title 32 missions, mobilization readiness, domestic emergency response, and classified SIPRNet operations; within that environment, this position helps maintain secure baseline configurations and continuous compliance across the enterprise. The technician operates within a cybersecurity ecosystem that includes ACAS, eMASS, STIG Manager, USIEM-supported monitoring, and coordination with NETCOM Global Cyber Center and DISA DCDC to help preserve ARNG cyber freedom of action while denying it to adversaries.
Responsibilities- Execute authenticated and unauthenticated ACAS scans across ARNG network environments to identify vulnerabilities and assess enterprise exposure.
- Analyze scan results to validate findings, determine remediation relevance, and support vulnerability assessment activities aligned with Task 3 cybersecurity operations deliverables.
- Verify scan credential integrity, asset coverage, and data quality to improve the accuracy and completeness of enterprise vulnerability reporting.
- Coordinate remediation tracking with system owners and other stakeholders to support timely correction of vulnerabilities affecting classified and unclassified ARNG environments.
- Perform rescans to confirm corrective actions and validate closure of identified vulnerabilities.
- Update POA&Ms and associated records to reflect current remediation status and compliance posture in support of RMF processes.
- Support operational reporting aligned with STIGs, IAVMs, DoD and ARNG cybersecurity directives, and ongoing compliance management requirements.
- Contribute vulnerability management data and status updates that support broader SOC operations, continuous monitoring, and cybersecurity engineering activities coordinated with the NETCOM Global Cyber Center and DISA DCDC.
- Assist in maintaining ARNG secure baseline configuration objectives by helping identify, document, and verify vulnerabilities across the enterprise environment, including systems supporting approximately 141,000 endpoints at roughly 2,800 sites.
Required QualificationsU.S. Citizenship is required
Security Clearance: Secret Eligible
Required Certifications: DCWF Work Role 541-Vulnerability Assessment Analyst - Basic proficiency; must hold ONE OR MORE of the following: CEH
Experience: 3+ years of experience in cybersecurity
- Hands-on experience executing authenticated and unauthenticated vulnerability scans and analyzing resulting findings.
- Experience validating scan coverage, credential integrity, and data accuracy to support reliable vulnerability assessment results.
- Experience tracking remediation actions with system owners and verifying corrective actions through rescans.
- Experience updating POA&Ms and supporting documentation aligned to RMF-related cybersecurity activities.
- Working knowledge of STIGs, IAVMs, and DoD/ARNG cybersecurity directives as applied to vulnerability management operations.
- Experience supporting enterprise operational reporting for cybersecurity compliance and remediation status.
- Ability to support vulnerability management activities within classified and unclassified network environments.
