Is there an OPSEC violation reporting POC to whom someone could direct me?

You can reach out to the COR for that Contractor. You can also reach out to the base security manager.

I would provide the info to the IG. If you know who the COTR or KO are, write them an MFR with screenshots

Start with your unit security NOC/Officer. They should know whom to contact in the contracting system. Each government contractor with employees holding clearances must have a corporate security office and officer. They will eventually end up handling the situation.

If the Contractor is part of your organization find out who the COR or KO is for the contract and let them know. No matter which route you take they will eventually need to be involved. If you cannot identify the COR or KO, then I would report the incident through your S-2 channels. Most Contractors have either a security clearance or back ground check and your S-2 can use JPAS to determine who is either the owner or servicing agency for there clearance information and they can start the process with that organization.

JAG is the only choice if it is an OPSEC breach.