MAS - Trewon Technologies LLC - 47QRAA18D00DQ

1 | P a g e

GENERAL SERVICES ADMINISTRATION

Federal Acquisition Service

Authorized Federal Supply Schedule FSS Price List

Trewon Technologies LLC 722 E Market Street, Suite 102, OFC A57

Leesburg, VA 20176

(P) 703-242-1378 | (F) 703-337-0334 Website: http://www.trewon.com

Contract Administrator: : Bijal Shah, bijal.shah@trewon.com

Contract Number: 47QRAA18D00DQ Contract Period: August 8, 2018 – August 7, 2028

Business Size: Small Business, Women-Owned Small Business (WOSB), Economically Disadvantaged Women-Owned Small Business (EDWOSB), SBA Certified Small Disadvantaged Business, MAS 8(a) Pool- Competitive, MAS 8(a) Pool- Sole Source and Competitive (exit date: Jul 10, 2025), SBA Certified HUBZone Firm

Schedule Title: Multiple Award Schedule

Federal Supply Group: Information Technology & Professional Services

Pricelist current as of Modification PS-0025, effective 08/12/2025.

Online access to contract ordering information, terms and conditions, pricing, and the option to create an electronic delivery order are available through GSA Advantage!®. The website for GSA Advantage!® is: https://www.GSAAdvantage.gov.

For more information on ordering, go to the following website: https://www.gsa.gov/schedules.

Prices Shown Herein are Net (discount deducted).

https://www.gsaadvantage.gov/ https://www.gsa.gov/schedules

2 | P a g e

CUSTOMER INFORMATION:

1a. Table of Awarded Special Item Number(s) with appropriate cross-reference to page numbers:

SINs SIN Title 541219/541219RC Budget and Financial Management Services 54151HACS/54151HACSRC Highly Adaptive Cybersecurity Services (HACS) 54151S/54151SRC Information Technology Professional Services 541611/541611RC Management and Financial Consulting, Acquisition and

Grants Management Support, and Business Program and Project Management Services

611430/611430RC Professional and Management Development Training OLM/OLMRC Order-Level Materials

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. See Price List.

1c. If the Contractor is proposing hourly rates a description of all corresponding commercial job titles, experience, functional responsibility, and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item. See Labor Category Descriptions beginning on Page 4.

2. Maximum Order: SIN 54151HACS and 54151S - $500,000 SIN 541219, 541611, and 611430 - $1,000,000

SIN OLM - $250,000

3. Minimum Order: $100.00

4. Geographic Coverage: Domestic.

5. Point(s) of production: Same as company address.

6. Discount from list prices or statement of net price: Government net prices (discounts already deducted).

7. Quantity discounts: None.

8. Prompt payment terms: Net 30 Days. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. Foreign items: None.

10a. Time of Delivery: Specified on the Task Order.

10b. Expedited Delivery: Contact Contractor.

10c. Overnight and 2-day delivery: Contact Contractor.

3 | P a g e

10d. Urgent Requirements: Contact Contractor.

11. F.O.B Points: Destination.

12a. Ordering Address: Same as Company Address.

12b. Ordering procedures: See Federal Acquisition Regulation (FAR) 8.405-3.

13. Payment address: Same as Company Address.

14. Warranty provision: Contractor’s standard commercial warranty.

15. Export Packing Charges: N/A

16. Terms and conditions of rental, maintenance, and repair: N/A

17. Terms and conditions of installation: N/A

18a. Terms and conditions of repair parts: N/A

18b. Terms and conditions for any other services: N/A

19. List of service and distribution points: N/A

20. List of participating dealers: N/A

21. Preventive maintenance: N/A

22a. Environmental attributes, e.g., recycled content, energy efficiency, and/or reduced pollutants: N/A

22b. If applicable, indicate that Section 508 compliance information is available for the information and communications technology (ICT) products and services and show where full details can be found (e.g. contractor’s website or other location.) ICT accessibility standards can be found at:

https://www.Section508.gov/ and http://www.trewon.com.

23. Unique Entity Identifier (UEI) Number: EPE8N2747L14

24. Notification regarding registration in System for Award Management (SAM) database:

Trewon Technologies LLC is registered at SAM.gov.

4 | P a g e

Labor Category Descriptions SINs 541219 and 541611

Evaluation Specialist I Functional Responsibility: Provides analytical support in areas such as policy and budget formulation or analysis, financial and program evaluation and assessment, accounting technical assistance, strategic, financial, and business planning, and operations research and analysis. May make recommendations for policy, program, or process improvements on a variety of topics, including financial, managerial, technical, social, and programmatic.

Minimum Education: Associates Degree

Minimum Relevant Experience: 1 Year

Project Manager I Functional Responsibility: Support project manager, manages elements of the project or small projects, facilitates project team coordination ensuring production of contract deliverables, some communication with the client. Supports project budget formation, review, and reporting. Track project budgets and resolves financial issues. Projects supported may be programmatic, financial, managerial, or technical in nature.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 2 Years

Project Manager II Functional Responsibility: Control, plan and direct all aspects of the project and project team to include schedule, operations, and financial management. Organize and assign responsibilities to subordinates and oversee the successful completion of assigned tasks. Takes projects from original concept through final implementation. Interfaces with all areas affected by the project including end users, computer services, and client services. Defines project scope and objectives. Develops detailed work plans, schedules, project estimates, budgets, resource plans, and status reports. Conducts project meetings and is responsible for project tracking and analysis. Ensures adherence to quality standards and reviews project deliverables. Manages the integration of vendor tasks and tracks and reviews vendor deliverables. Provides technical and analytical guidance to project team. Recommends and takes action to direct the analysis and solutions of problems. Reviews budget execution and takes corrective actions as required. Projects supported may be programmatic, financial, managerial, or technical in nature.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

5 | P a g e

Research Assistant Functional Responsibility: Leads information gathering, conducts primary and secondary research, develops presentations, databases and spreadsheets, analyzes programmatic, managerial, social, technical, and financial data, drafts project reports, and other deliverables. Identifies project issues and guides associate consultants/analysts. Supports presentation of project findings and results to client management. Conducts financial management including transaction analysis, classification, and processing.

Minimum Education: Associates Degree

Minimum Relevant Experience: 1 Year

Subject Matter Expert I Functional Responsibility: Provides highest-level functional expertise on subject matters which may be financial, programmatic, managerial, social, or technical in nature. Analyzes complex problems, makes recommendations, develops alternative solutions and draft and executes implementation plan.

Converses with and provides assistance to highest levels of management. Ability to draft reports for publishing in peer reviewed journals. For financial management efforts, support includes developing and updating accounting policies and procedures; assessing and recommending improvements to budgetary processes; and conducting special studies on accounting operations.

Minimum Education: Masters Degree

Minimum Relevant Experience: 8 Years

Experience & Degree Substitution Equivalencies Experience exceeding the minimum shown may be substituted for education. Likewise, education exceeding the minimum shown may be substituted for experience.

Labor Category Standard Qualifications Substitution

Min Edu Min Exp Masters Bachelors Associates High School

Evaluation Specialist I Associates 1 0 0 N/A 5

Project Manager I Bachelors 2 0 N/A 6 8

Project Manager II Bachelors 4 0 N/A 8 10

Research Assistant Associates 1 0 0 N/A 5

Subject Matter Expert I Masters 8 N/A 12 16 18

6 | P a g e

Service Contract Labor Standards: The Service Contract Labor Standards (SCLS) are applicable to this contract as it applies to the entire Consolidated MAS Schedule and all services provided. While no specific labor categories have been identified as being subject to SCLS due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CRF 541.300), this contract still maintains the provisions and protections for SCLS eligible labor categories. If and / or when the contractor adds SCLS labor categories / employees to the contract through the modification process, the contractor must inform the Contracting Officer and establish a SCLS matrix identifying the GSA labor category titles, the occupational code, SCLS labor category titles and the applicable WD number. Failure to do so may result in cancellation of the contract.

7 | P a g e

SINs 541219, 541611, and 611430

Evaluation Specialist IV Functional Responsibility: Designs and directs or serves as the principal investigator for research, financial management, management consulting, information technology, and training projects involving advanced statistical, modeling, data analysis, or policy analysis techniques. Leads key tasks on larger research projects. Supervises junior staff working on research projects, and monitors the quality, timeliness, and cost-effectiveness of their work. Assists other staff in resolving project problems, especially in technical areas. Represents expertise in a specific research or policy area through technical communications, special studies, testimony, publications, and conferences, reaching beyond the contracting agencies. Revises project deliverables prepared by other staff for technical quality and effectiveness of communication. Supports the management of projects to meet quality standards, deliverable schedules, and budgets. Provides technical assistance for improving budgeting and accounting processes and operations.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 10 Years

Program Director Functional Responsibility: Acts as program director or principal investigator for major research, financial management, information technology and training projects. Represents the company through published material, papers, and testimony on implications of research efforts. Designs and monitors the carrying out of research, financial management, and information technology projects involving advanced statistical, modeling and analysis techniques. Formulates and conducts complex special studies, reviews, and training on research, budgeting, accounting, programmatic, social, managerial, training, and technical processes and operations. Serves as expert technical resources to projects. Oversees and manages programs and projects to ensure performance, budgets and schedules objectives are met.

Serves as the senior point of contact with government executive, technical, and contracting personnel.

Minimum Education: Masters Degree

Minimum Relevant Experience: 12 Years

8 | P a g e

Researcher/Evaluator II Functional Responsibility: Independently manages technical, financial, and program tasks. Provides knowledge of and experience in related functional areas addressed by the project, general knowledge of government contracting practices, environments, standards, and procedures. Drafts excellent written and oral communications for diverse audience including technical and managerial staff, as well as client staff. Produces client deliverables with technical supervision. Responsible for coordinating all tasks and activities of a project to ensure accurate communication between client and contractor staff, identifying and resolving issues as they arise, alerting specialists to changes in project scope, and generally ensuring the quality and timeliness of each deliverable. Provide in-depth expert training in specialized content or management area. Provides technical assistance to develop or revise accounting policies and procedures, improve budget preparation and execution, and transaction analysis and processing.

Conduct formal classroom training, prepare materials for instructors and students, and coordinate classes. Identify courses that should be developed, and conduct research necessary to develop and revise training courses.

Minimum Education: Masters Degree

Minimum Relevant Experience: 3 Years

Senior Researcher Functional Responsibility: Provides national expertise and experience in designing and implementing all phases of the research process for subject area which may be financial, programmatic, managerial, social, or technical in nature. Plans and conducts literature and data review, data collection, data analysis, program evaluation and assessment, writing, and quality assurance review. Makes recommendations for policy, program, or process improvements. Conducts special studies and reviews on program, social, accounting, budget, and technical processes and operations. Oversees and coordinates work of Research Associates and Data Analysis. Provide in-depth expert training in specialized content or management area. Direct, coordinate, and exercises functional authority for facilitation, planning, organization, control, integration, and completion of project within area of assigned responsibility.

Minimum Education: PhD Degree

Minimum Relevant Experience: 10 Years

Experience & Degree Substitution Equivalencies

Min Edu Min Exp Masters Bachelors Associates High School

Evaluation Specialist IV Bachelors 10 6 N/A 14 16

Program Director Masters 12 N/A 16 20 22

Researcher/Evaluator II Masters 3 N/A 7 11 13

Senior Researcher PhD 10 N/A N/A N/A N/A

9 | P a g e

Service Contract Labor Standards: The Service Contract Labor Standards (SCLS) are applicable to this specific labor categories have been identified as being subject to SCLS due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CRF 541.300), this contract still maintains the provisions and protections for SCLS eligible labor categories. If and / or when the contractor adds SCLS labor categories / employees to the contract through the modification process, the contractor must inform the Contracting Officer and establish a SCLS matrix identifying the GSA labor category titles, the occupational code, SCLS labor category titles and the applicable WD number. Failure to do so may result

10 | P a g e

SINs 541219 and 611430

Analyst Functional Responsibility: Perform various duties related to research, analysis, evaluation, and managing ongoing projects. Review documents and processes for compliance. Provide in-depth expert training in specialized content or management area, which may be programmatic, managerial, social, financial, or technical. Provides budget and accounting support, including transaction analysis, transaction processing, transaction classification, data analysis, training, and reporting. Conduct formal classroom training, prepare materials for instructors and students, and coordinate classes. Identify courses that should be developed, and conduct research necessary to develop and revise training courses. Analyze results from training evaluations, and write reports on the training evaluations and any other issues that may arise.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 2 Years

Experience & Degree Substitution Equivalencies

Min Edu Min Exp Masters Bachelors Associates High School

Analyst Bachelors 2 0 N/A 6 8

Service Contract Labor Standards: The Service Contract Labor Standards (SCLS) are applicable to this specific labor categories have been identified as being subject to SCLS due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CRF 541.300), this contract still maintains the provisions and protections for SCLS eligible labor categories. If and / or when the contractor adds SCLS labor categories / employees to the contract through the modification process, the contractor must inform the Contracting Officer and establish a SCLS matrix identifying the GSA labor category titles, the occupational code, SCLS labor category titles and the applicable WD number. Failure to do so may result

11 | P a g e

SIN 54151HACS

Junior Cybersecurity Analyst Functional Responsibility: Monitors network traffic for security incidents and events. Investigates incidents and respond to events in real time. Writes detailed incident response reports. Installs and operate firewalls, encryption programs, and other security software. Fixes vulnerabilities. Develops and promotes best practices for information security. Conducts threat research. Performs periodic risk assessments and penetration tests.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 2 Years

Junior Cybersecurity Developer Functional Responsibility: Implements, tests, and operates software security techniques in compliance with technical reference architecture. Performs on-going security testing and code review to improve software security. Troubleshoots and debugs issues that arise. Provides engineering designs for new software solutions to help mitigate security vulnerabilities. Contributes to basic levels of the architecture. Maintains technical documentation. Consults team members on secure coding practices.

Develops a familiarity with new tools and best practices.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Junior Cybersecurity Specialist Functional Responsibility: Determines security violations and inefficiencies by conducting periodic audits. Upgrades our network and infrastructure systems. Implements and maintains security controls.

Identifies and solves potential and actual security problems. Assesses the current situation, evaluating trends and anticipating security requirements. Keeps users informed by preparing performance reports, communicating system status. Maintains quality service by following organization standards. Maintains technical knowledge by attending educational workshops. Contributes to team effort by accomplishing related results as needed.

Minimum Relevant Experience: 2 Years

12 | P a g e

Midlevel Cyber Vulnerability Management SME Functional Responsibility: Performs as a technical SME in area of cyber security. Incorporates threat intelligence into countermeasures to detect and prevent intrusions and malware infestation. Identifies threat actor tactics, techniques and procedures and based on indicators develops custom signatures and blocks. Applies tools & techniques to efficiently identify trends and extract indicators from large data sources. Applies key networking concepts relevant to the security intelligence process. Implements key forensics and incident response concepts critical to the Security Intelligence process. Works with various categories of electronic evidence including media, email, and networks and studies the detection and prevention of intrusion and attacks. Provides structured digital evidence collection and evaluation and packet analysis. Examines different methods of policy creation, implement a security policy, and create a policy document. Handles and organize disparate data about detections, attacks, and attackers. Applies discovery techniques and vetting of new intelligence. Builds better actionable intelligence from data.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Cybersecurity Analyst Functional Responsibility: Monitors complex network traffic for security incidents and events.

Investigates complex incidents and respond to events in real time. Writes detailed incident response reports. Installs and operate firewalls, encryption programs, and other security software. Fixes vulnerabilities. Develops and promotes best practices for information security. Conducts threat research. Performs periodic risk assessments and penetration tests.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Cybersecurity Defense Analyst Functional Responsibility: Develops content for cyber defense tools. Characterizes and analyzes network traffic to identify anomalous activity and potential threats to network resources. Coordinates with enterprise-wide cyber defense staff to validate network alerts. Ensures that cybersecurity-enabled products or other compensating security control technologies reduce identified risk to an acceptable level. Documents and escalates incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment. Performs cyber defense trend analysis and reporting. Performs event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack. Performs security reviews and identifies security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy. Plans and recommends modifications or adjustments based on exercise results or system environment. Provides daily summary reports of network events and activity relevant to cyber defense practices. Receives and analyzes network alerts from various sources within the enterprise and determine possible causes of such alerts.

Provides timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities. Uses cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.

Analyzes identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information. Determines tactics, techniques, and procedures (TTPs) for intrusion sets.

Examines network topologies to understand data flows through the network. Recommends computing environment vulnerability corrections. Identifies and analyzes anomalies in network traffic using metadata. Conducts research, analysis, and correlation across a wide variety of all source data sets

13 | P a g e

(indications and warnings). Validates intrusion detection system (IDS) alerts against network traffic using packet analysis tools. Isolates and removes malware. Identifies applications and operating systems of a network device based on network traffic. Reconstructs a malicious attack or activity based off network traffic. Identifies network mapping and operating system (OS) fingerprinting activities. Assists in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave. Notifies designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan. Analyzes and reports organizational security posture trends. Analyzes and reports system security posture trends. Assess adequate access controls based on principles of least privilege and need-to-know. Monitors external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber defense threat condition and determine which security issues may have an impact on the enterprise. Assess and monitors cybersecurity related to system implementation and testing practices.

Provides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.

Works with stakeholders to resolve computer security incidents and vulnerability compliance. Provides advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Cybersecurity Developer Functional Responsibility: Implements, tests, and operates moderately advanced software security techniques in compliance with technical reference architecture. Performs on-going security testing and code review to improve software security. Troubleshoots and debugs moderately complex issues that arise. Provides engineering designs for new software solutions to help mitigate security vulnerabilities.

Contributes to most levels of the architecture. Maintains technical documentation. Consults team members on secure coding practices. Develops a familiarity with new tools and best practices.

Minimum Relevant Experience: 6 Years

14 | P a g e

Midlevel Cybersecurity Engineer Functional Responsibility: Conducts risk assessments, vulnerability analyses, penetration testing, and provide domain level recommendations. Responds to system and network security incidents.

Investigates and resolves standard security vulnerabilities with minimal oversight, including firewalls, electronic data traffic, network access, and architectures. Performs total system analyses to include but not limited to design, configuration, testing, installation, operation, maintenance, and disposal. Provides recommendations for the development of internal and external customer enterprise-wide cyber systems, networks, and applications solutions. Participates in the testing, implementation, and operation of secure operating systems, networks, databases, and security event monitoring products.

Participates in the design of security solutions. Assists with the forensic preservation of hard drives. May recommend processes and procedures. Maintains documentation and correct as necessary. Supports the integration of new technology; provides basic architectural analysis. Researches and stays current on industry best practices. Demonstrates proficient understanding of system and network security principles and technology.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Cybersecurity Program Manager Functional Responsibility: Develops and maintains strategic plans. Performs needs analysis to determine opportunities for new and improved business process solutions. Provides enterprise cybersecurity and supply chain risk management guidance for development of the Continuity of Operations Plans. Ensures that all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals. Acts as a primary stakeholder in the underlying information technology (IT) operational processes and functions that support the service, provide direction, and monitor all significant activities so the service is delivered successfully. Manages the internal relationship with information technology (IT) process owners supporting the service, assisting with the definition and agreement of Operating Level Agreements (OLAs). Participates in the acquisition process as necessary. Leads and oversees budget, staffing, and contracting.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Midlevel Cybersecurity Project Manager Functional Responsibility: Sets up the program of work and delegating targets to the project team.

Ensures communication to all stakeholders across all levels including detailed engineering and operational level communications program and executive management project status, issues, and risk reporting. Ensures project success and completion. Works with program manager(s) to identify and manage project dependencies. Project planning and initiation, including scope negotiation with CIB applications / systems partner application development teams. Creates a collaborative partnership among executive leaders and stakeholders and enables resource demand planning, change management, and project pipeline planning decisions. Participates as systems / process analyst resource for project managers to achieve goals. Undertakes requirements elicitation and definition to determine project scope. Coordinates with larger program team to ensure project compatibility and schedule of deliverables. Assesses risk factors of a project.

15 | P a g e

Principal Cybersecurity Analyst Functional Responsibility: Leads the monitoring of complex network traffic for security incidents and events. Investigates extremely complex incidents and respond to events in real time. Writes detailed incident response reports. Installs and operates firewalls, encryption programs, and other security software. Fixes extremely complex vulnerabilities. Develops and promotes best practices for information security. Conducts threat research. Performs periodic risk assessments and penetration tests.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 8 Years

Senior Cyber Vulnerability Management SME Functional Responsibility: Performs as a lead technical SME in area of cyber security. Incorporates threat intelligence into countermeasures to detect and prevent intrusions and malware infestation.

Identifies threat actor tactics, techniques and procedures and based on indicators develops custom signatures and blocks. Applies tools & techniques to efficiently identify trends and extract indicators from large data sources. Applies key networking concepts relevant to the security intelligence process.

Implements key forensics and incident response concepts critical to the Security Intelligence process.

Works with various categories of electronic evidence including media, email, and networks and studies the detection and prevention of intrusion and attacks. Provides structured digital evidence collection and evaluation and packet analysis. Examines different methods of policy creation, implement a security policy, and create a policy document. Handles and organizes disparate data about detections, attacks, and attackers. Applies discovery techniques and vetting of new intelligence. Builds better actionable intelligence from data.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Analyst Functional Responsibility: Supervises the monitoring of network traffic for security incidents and events. Investigates highly complex incidents and respond to events in real time. Writes detailed incident response reports. Installs and operate complex firewalls, encryption programs, and other security software. Fixes highly complex vulnerabilities. Develops and promotes best practices for enterprise information security. Conducts complex threat research. Performs periodic risk assessments and penetration tests.

16 | P a g e

Senior Cybersecurity Cloud Administrator Functional Responsibility: Installs, administers, and troubleshoots network security solutions on Cloud platforms. Updates software with the latest security patches and ensuring the proper defenses are present for each Cloud resource. Performs vulnerability and penetration tests, identifying and defending against threats, and developing disaster recovery plans. Configures Cloud security systems, analyzing security requirements, and recommending improvements. Creates Cloud policies and authorization roles and defending against unauthorized access, modifications, and destruction. Consults with staff, managers, and executives about the best security practices and providing technical advice. Configures and support Cloud security tools. Trains staff to understand and use Cloud security protocols.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Data Management Specialist Functional Responsibility: Provides dedicated host-based security system administration and documentation support. Coordinates with program teams to create cybersecurity architecture and design documents for all cybersecurity architecture. Employs best practices when implementing security controls including software engineering methodologies, system / security engineering principle, secure design, secure architecture, and secure coding techniques. Develops cybersecurity architecture and design plans for communication and collaboration products, operating system platforms including servers, devices, management products, applications and overall security related to implementing these products. Integrates cybersecurity expertise into lifecycle management, planning architecture and design management, migration and deployment, and system testing and implementation. Researches, develops, tests and documents architectures and solutions for implementing new cybersecurity technologies to provide more seamless information collaboration and cybersecurity capabilities for the program and its user base. Develops and provides a criticality analysis of logic-bearing system components (e.g., hardware, firmware, and software) implementing, protecting, or introducing vulnerability(s) to each function. Interprets, analyzes, and reports all events and anomalies in accordance with computer network directives, including initiating, responding, and reporting discovered events. Identifies security risks and exposures, determines the causes of security violations, and suggests procedures to halt future incidents and improve security. Develops and documents techniques and procedures for conducting cybersecurity risk assessments and compliance audits, the evaluation and testing of hardware, firmware, and software for possible impact on system security, and the investigation and resolution of security incidents such as intrusion, frauds, attacks, or leaks. Provides guidance and leadership to less-experienced cybersecurity personnel.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Data Policy Specialist Functional Responsibility: Lead and participate in activities that provide policy and governance for the cybersecurity program. Lead and participate in the creation, review, and technical assessment of all policies and procedures supporting the security for computing systems that include but are not limited to system security plans, vulnerability management, risk management, configuration management, change management, and others. Provide knowledge and expertise in government regulatory processes and documentation, including but not limited to risk management approach (RMA), National Institute of Standards and Technology (NIST) standards, and policies and procedures. Lead internal and external assessments / audits of information technology, managed services, software as a service, and all other

17 | P a g e services. Responsible for the assessment of the system security protection measures and documentation for applicable systems. Make recommendations for improvements in cybersecurity controls. Perform oversight surveys and assessments of computing systems, enclaves, and services to ensure mandated controls have been implemented as required by Federal regulations. Develop sophisticated concepts and techniques in the cybersecurity assessment program. Assist in all cybersecurity efforts including continuous monitoring, reporting, participation on project teams, incident management, and supporting the information system security manager (ISSM). Work closely with the mission organizations to provide guidance, training, and tools necessary for protecting the cybersecurity program.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Defense Analyst Functional Responsibility: Develops content for advanced cyber defense tools. Characterizes and analyzes complex network traffic to identify anomalous activity and potential threats to network resources. Coordinates with enterprise-wide cyber defense staff to validate network alerts. Ensures that cybersecurity-enabled products or other compensating security control technologies reduce identified risk to an acceptable level. Documents and escalates complex incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment. Performs cyber defense trend analysis and reporting. Performs complex event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack. Performs complex security reviews and identify security gaps in security architecture resulting in recommendations for inclusion in the risk mitigation strategy. Plans and recommends modifications or adjustments based on complex exercise results or system environment. Provides daily summary reports of network events and activity relevant to cyber defense practices. Receives and analyzes network alerts from various sources within the enterprise and determine possible causes of such alerts. Provides timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities. Uses advanced cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity. Analyzes identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information. Determines advanced tactics, techniques, and procedures (TTPs) for intrusion sets. Examines network topologies to understand data flows through the network. Recommends computing environment vulnerability corrections. Identifies and analyzes anomalies in complex network traffic using metadata. Conducts research, analysis, and correlation across a wide variety of all source data sets (indications and warnings). Validates intrusion detection system (IDS) alerts against network traffic using packet analysis tools. Isolate and remove malware. Identifies applications and operating systems of a network device based on network traffic. Reconstructs a malicious attack or activity based off network traffic. Identifies complex network mapping and operating system (OS) fingerprinting activities. Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave. Notifies designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan. Analyzes and reports organizational security posture trends.

Analyzes and reports system security posture trends. Assesses adequate access controls based on principles of least privilege and need-to-know. Monitors external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber

18 | P a g e defense threat condition and determine which security issues may have an impact on the enterprise.

Assesses and monitors complex cybersecurity related to system implementation and testing practices.

Provides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.

Works with stakeholders to resolve computer security incidents and vulnerability compliance. Provides advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Developer Functional Responsibility: Implements, tests, and operates highly advanced software security techniques in compliance with technical reference architecture. Performs on-going security testing and code review to improve software security. Troubleshoots and debugs highly complex issues that arise.

Provides engineering designs for new software solutions to help mitigate security vulnerabilities.

Contributes to all levels of the architecture. Maintains technical documentation. Consults team members on secure coding practices. Develops a familiarity with new tools and best practices.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Senior Cybersecurity Engineer Functional Responsibility: Conducts highly complex risk assessments, vulnerability analyses, penetration testing, and provide enterprise-wide recommendations. Responds to complex system and network security incidents; investigates and resolves non-standard security vulnerabilities. Designs and recommends security solutions. Performs total system analyses and provide recommendations. Provides recommendations for the development of internal and external enterprise-wide cyber systems, networks, and applications solutions, interface directly with vendors. Performs complex testing, implementation, and operation of secure operating systems, networks, databases, and security event monitoring products. Performs and analyzes forensic preservation of hard drives. May interface with external entities including law enforcement and intelligence/government agencies. Recommends processes, procedures, and security standards to promote operational efficiency. Designs and integrates new complex architectural features; provides architectural and engineering analyses. Embeds advanced cyber defense techniques for incident response. Assists in the development and delivery of cyber security training material. Participates in the tactical execution of Cyber Incident Response Team (CIRT).

May provide guidance to lower-level Engineers. Develops communications in addressing system and network security principles and technology solutions.

19 | P a g e

Senior Information Assurance Engineer Functional Responsibility: Plans, implements, manages, monitors, and upgrades complex security measures for the protection of the organization's data, systems, and networks. Troubleshoots complex security and network problems. Responds to all system and/or network security breaches. Ensures the organization's data and infrastructure are protected by enabling the appropriate security controls.

Participates in the change management process. Tests and identifies network and system vulnerabilities.

Involves daily administrative tasks, reporting, and communication with the relevant departments in the organization.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Experience & Degree Substitution Equivalencies

Min Edu Min Exp Masters Bachelors Associates High School

Junior Cybersecurity Analyst Bachelors 2 0 N/A 6 8

Junior Cybersecurity Developer Bachelors 4 0 N/A 8 10

Junior Cybersecurity Specialist Bachelors 2 0 N/A 6 8

Midlevel Cyber Vulnerability Management SME Bachelors 4 0 N/A 8 10

Midlevel Cybersecurity Analyst Bachelors 4 0 N/A 8 10

Midlevel Cybersecurity Defense Analyst Bachelors 4 0 N/A 8 10

Midlevel Cybersecurity Developer Bachelors 6 2 N/A 10 12

Midlevel Cybersecurity Engineer Bachelors 4 0 N/A 8 10

Midlevel Cybersecurity Program Manager Bachelors 6 2 N/A 10 12

Midlevel Cybersecurity Project Manager Bachelors 4 0 N/A 8 10

Principal Cybersecurity Analyst Bachelors 8 4 N/A 12 14

Senior Cyber Vulnerability Management SME Bachelors 6 2 N/A 10 12

Senior Cybersecurity Analyst Bachelors 6 2 N/A 10 12

Senior Cybersecurity Cloud Administrator Bachelors 6 2 N/A 10 12

Senior Cybersecurity Data Management Specialist Bachelors 6 2 N/A 10 12

Senior Cybersecurity Data Policy Specialist Bachelors 6 2 N/A 10 12

20 | P a g e

Min Edu Min Exp Masters Bachelors Associates High School Senior Cybersecurity Defense Analyst Bachelors 6 2 N/A 10 12

Senior Cybersecurity Developer Bachelors 6 2 N/A 10 12

Senior Cybersecurity Engineer Bachelors 6 2 N/A 10 12

Senior Information Assurance Engineer Bachelors 6 2 N/A 10 12

Service Contract Labor Standards: The Service Contract Labor Standards (SCLS) are applicable to this specific labor categories have been identified as being subject to SCLS due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CRF 541.300), this contract still maintains the provisions and protections for SCLS eligible labor categories. If and / or when the contractor adds SCLS labor categories / employees to the contract through the modification process, the contractor must inform the Contracting Officer and establish a SCLS matrix identifying the GSA labor category titles, the occupational code, SCLS labor category titles and the applicable WD number. Failure to do so may result

21 | P a g e

SIN 54151S

Application Systems Analyst, Principal Functional Responsibility: Provides highly technical and specialized guidance, and solutions to, complex Internet technology challenges, based on a high level of demonstrated experience. Provides direction.

Provides independent services and leadership in specialized technology area. Provides expert advice and assistance in state-of-the-art Internet software/hardware solutions involving hardware of various capabilities, multiple hardware/software platforms, database management systems, specialized software, data communications facilities and protocols, fourth generation technologies, and complex software tools or packages. Performs analyses and studies, enhances or implements system software solutions, performs test and acceptance phases. Has experience in data-driven Web applications and integrating components and technologies that comprise current and future Web product deployment.

Requires database, deployment, integration, and optimization skills. Must understand traditional methods of Web development.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Database Administrator, Principal Functional Responsibility: Responsible for the overall system design, development and deployment of an IT solution. Documents development requirements for database, applications, and operation system environment. Consults with end users to test and debug applications to meet client needs. Serves expertise in all aspects of designing and application development. May conduct training to IT Staff.

Demonstrates expertise in a variety of the field's concepts, practices, and procedures. Relies on extensive experience and judgment to plan and accomplish goals. Performs a variety of complicated tasks. May provide consultation on complex projects and is considered to be the top level contributor/specialist. For complex projects, Database Administrator, Principal may be responsible for supporting a specific component of the solution architecture. Supports the capture, analysis and synthesis of both the technical and business requirements; the development of the conceptual and detailed design of the IT solution; and overall responsibility and technical leadership of the delivery team. Database Administrator, Principal provides support during the implementation and integration phases of the project.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 6 Years

Midlevel Operations Research Analyst Functional Responsibility: Conducts technical analysis of information technology problems and software application requirements, then formulates computational models of problems for software solutions..

Prepares computational models that relate constants and variables, restrictions, alternatives, conflicting objectives, and their numerical parameters that can be readily converted to software code or scripts.

Gathers, relates, and identifies data with variables in models by applying judgment and computational tests. Reviews operations and testing of computational models to ensure adequacy, or determines needs for reformulation. Prepares written reports indicating IT data solutions or a range of possible alternatives in rank of desirability and probability of success when there is no single solution to improve overall IT operational efficiency.

22 | P a g e

Midlevel Software Architect / Engineer Functional Responsibility: Provide architecture, design, and testing of moderately complex IT systems, including those with multiple software programming languages and full-stack. Possesses a strong technical foundation in software programming languages, databases, and software development principles. Identify and resolve information technology issues related to software engineering, independently. Collaborate with other software engineers, software architects and product stakeholders. Effectively communicates information technology concepts and solutions, ensuring information system function and security.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Systems Requirements Analyst Functional Responsibility: Gathers and analyzes requirements while creating detailed documentation that clearly outlines the functional and non-functional requirements for the information technology software application system. Works with software developers to design and implement technical solutions that meet the documented requirements through testing and analysis. Identifies inefficiencies and recommends improvements to the system design. Engages in testing and quality assurance activities to ensure the IT system meets requirements.

Minimum Education: Bachelors Degree

Minimum Relevant Experience: 4 Years

Midlevel Vulnerability Analyst Functional Responsibility: Leads technical teams to identify, assess, and mitigate complex IT system, network, and software application security vulnerabilities. Addresses potential weaknesses in IT systems, software, networks, and applications. Develops and implements remediation plans, reports, and dashboards to address vulnerabilities and reduce the risk of exploitation.