MAS - Braingu LLC - 47QTCA19D00HE

General Services Administration Federal Supply Service

Authorized Federal Supply Schedule Price List

IT Schedule: 70 General Purpose Commercial Information Technology Equipment, Software, and Services

Category: 54151S: Information Technology Professional Service

54151HACS: Highly Adaptive Cybersecurity Service

Contract Number: 47QTCA19D00HE

Period Covered by Contract:

August 13, 2019 through August 12, 2024

DUNS: 078585722

BrainGu, LLC

250 Monroe Ave NW Ste 400 Grand Rapids, MI 49503-2293

Telephone: 813-598-3618 Website: http://www.braingu.com

Contractor’s Administration Source: Alex Randall, Email: alex@braingu.com

Business Size: Small Business

Terms and Conditions

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs):

54151S: Information Technology Professional Service 54151HACS: Highly Adaptive Cybersecurity Service

1b. IDENTIFICATION OF THE LOWEST PRICED MODEL NUMBER AND LOWEST

UNIT PRICE FOR THAT MODEL FOR EACH SPECIAL ITEM NUMBER AWARDED

IN THE CONTRACT:

Please see the pricelist below for details.

1c. IF THE CONTRACTOR IS PROPOSING HOURLY RATES, A DESCRIPTION OF ALL

CORRESPONDING COMMERCIAL JOB TITLES, EXPERIENCE, FUNCTIONAL

RESPONSIBILITY AND EDUCATION FOR THOSE TYPES OF EMPLOYEES OR

SUBCONTRACTORS WHO WILL PERFORM SERVICES SHALL BE PROVIDED. IF

HOURLY RATES ARE NOT APPLICABLE, INDICATE NOT APPLICABLE FOR THIS

ITEM:

Please see the table below for details.

2. MAXIMUM ORDER*: $500,000

*If the “best value” selection places your order over this Maximum Order identified in this catalog/pricelist, you have an opportunity to obtain a better schedule contract price. Before placing your order, contact the aforementioned contractor for a better price. The contractor may (1) offer a new price for this requirement; (2) offer the lowest price available under this contract; or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the Schedule contract in accordance with FAR 8.404

3. MIMINUM ORDER: $100.00

4. GEOGRAPHIC COVERAGE: 54151HACS – Worldwide; 54151S – Worldwide;

5. POINT(S) OF PRODUCTION: 250 Monroe Ave NW Ste 400, Grand Rapids, MI 49503-2293

6. DISCOUNT FROM LIST PRICES: Net GSA pricing is listed in the attached pricing table

7. QUANTITY DISCOUNT(S): None

8. PROMPT PAYMENT TERMS: 0%, Net 30 Days

9a. Government purchase cards are accepted at or below the micro-purchase threshold

9b. Government purchase cards are not accepted above the micro- purchase threshold

10. FOREIGN ITEMS: None 11a. TIME OF DELIVERY: To be negotiated at the task order level

11b. EXPEDITED DELIVERY: To be negotiated at the task order level

11c. OVERNIGHT AND 2-DAY DELIVERY: To be negotiated at the task order level

11d. URGENT REQUIREMENTS: Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery

12. FOB POINT: Destination; 48 contiguous states and Washington, DC, as well as Alaska, Hawaii, and Puerto Rico

13a. ORDERING ADDRESS:

Grand Rapids, MI 49503-2293

13b. ORDERING PROCEDURES: For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in FAR 8.405-3

14. PAYMENT ADDRESS:

Grand Rapids, MI 49503-2293

15. WARRANTY PROVISION: N/A

16. EXPORT PACKING CHARGES: N/A

17. TERMS AND CONDITIONS OF GOVERNMENT PURCHASE CARD ACCEPTANCE:

Accepted at and below the micro-purchase threshold

18. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (if applicable).

N/A

19. TERMS AND CONDITIONS OF INSTALLATION (IF APPLICABLE): N/A

20. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS

PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE): N/A

20a. TERMS AND CONDITIONS FOR ANY OTHER SERVICES (IF APPLICABLE): N/A

21. LIST OF SERVICE AND DISTRIBUTION POINTS (IF APPLICABLE): N/A

22. LIST OF PARTICIPATING DEALERS (IF APPLICABLE): N/A

23. PREVENTIVE MAINTENANCE (IF APPLICABLE): N/A

24a. SPECIAL ATTRIBUITES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g. recycled content, energy efficiency, and/or reduced pollutants): N/A

24b. Section 508 Compliance for EIT: N/A

25. DUNS NUMBER: 078585722

26. NOTIFICATION REGARDING REGISTRATION IN SYSTEM FOR AWARD

MANAGEMENT (SAM) DATABASE: Active, CAGE Code 6H3P9

54151HACS: HIGHLY ADAPTIVE CYBERSECURITY SERVICE

PRICE SHEET

SIN Labor Category Price Offered to GSA (including IFF)

Year 1 Year 2 Year 3 Year 4 Year 5 54151HACS Cyber Application Architect 1 $ 139.61 $ 141.99 $ 144.40 $ 146.86 $ 149.35 54151HACS Cyber Application Systems

Analyst $ 161.54 $ 164.28 $ 167.08 $ 169.92 $ 172.81

54151HACS Cyber Enterprise Architect $ 188.82 $ 192.03 $ 195.29 $ 198.61 $ 201.99 54151HACS Cyber Operations Manager $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Cyber Program Analyst $ 152.44 $ 155.03 $ 157.66 $ 160.34 $ 163.07 54151HACS Cyber Security Specialist 1 $ 125.73 $ 127.86 $ 130.04 $ 132.25 $ 134.50 54151HACS Cyber Security Specialist 2 $ 158.54 $ 161.23 $ 163.98 $ 166.76 $ 169.60 54151HACS Cyber Security Specialist 3 $ 188.82 $ 192.03 $ 195.29 $ 198.61 $ 201.99 54151HACS Cyber Subject Matter

Authority (SMA) 1 $ 212.40 $ 216.02 $ 219.69 $ 223.42 $ 227.22

54151HACS Cyber Subject Matter Authority (SMA) 2

$ 244.65 $ 248.81 $ 253.04 $ 257.34 $ 261.71

54151HACS Cyber Subject Matter Authority (SMA) 3

$ 293.12 $ 298.10 $ 303.17 $ 308.32 $ 313.56

54151HACS Cyber Technical Architect 1 $ 120.70 $ 122.75 $ 124.84 $ 126.96 $ 129.12 54151HACS Cyber Technical Architect 2 $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Cyber Training Specialist $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Incident Response Analyst 1 $ 115.66 $ 117.63 $ 119.63 $ 121.66 $ 123.73 54151HACS Incident Response Analyst 2 $ 145.44 $ 147.91 $ 150.42 $ 152.98 $ 155.58 54151HACS Incident Response Analyst 3 $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Risk and Vulnerability Threat

Analyst 1 $ 115.66 $ 117.63 $ 119.63 $ 121.66 $ 123.73

54151HACS Risk and Vulnerability Threat Analyst 2

$ 145.44 $ 147.91 $ 150.42 $ 152.98 $ 155.58

54151HACS Risk and Vulnerability Threat Analyst 3

$ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66

54151HACS Security Operations Center (SOC) Analyst 1

$ 106.02 $ 107.82 $ 109.65 $ 111.52 $ 113.41

54151HACS Security Operations Center (SOC) Analyst 2

$ 125.73 $ 127.86 $ 130.04 $ 132.25 $ 134.50

54151HACS Security Operations Center (SOC) Analyst 3

$ 158.54 $ 161.23 $ 163.98 $ 166.76 $ 169.60

54151HACS Vulnerability Assessment Analyst and Penetration Tester 1

$ 125.73 $ 127.86 $ 130.04 $ 132.25 $ 134.50

54151HACS Vulnerability Assessment Analyst and Penetration Tester 2

$ 158.54 $ 161.23 $ 163.98 $ 166.76 $ 169.60

54151HACS Vulnerability Assessment Analyst and Penetration Tester 3

$ 188.82 $ 192.03 $ 195.29 $ 198.61 $ 201.99

54151HACS Cyber Security Analyst I $ 125.73 $ 127.86 $ 130.04 $ 132.25 $ 134.50 54151HACS Cyber Security Analyst II $ 158.54 $ 161.23 $ 163.98 $ 166.76 $ 169.60 54151HACS Cyber Security Analyst III $ 188.82 $ 192.03 $ 195.29 $ 198.61 $ 201.99 54151HACS Cyber Security Engineer I $ 125.73 $ 127.86 $ 130.04 $ 132.25 $ 134.50 54151HACS Cyber Security Engineer II $ 158.54 $ 161.23 $ 163.98 $ 166.76 $ 169.60 54151HACS Cyber Security Engineer III $ 188.82 $ 192.03 $ 195.29 $ 198.61 $ 201.99 54151HACS Cyber Project Manager I $ 147.90 $ 150.42 $ 152.97 $ 155.57 $ 158.22 54151HACS Cyber Project Manager II $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Cyber Project Manager III $ 196.37 $ 199.71 $ 203.10 $ 206.56 $ 210.07 54151HACS Cyber Program Manager I $ 147.90 $ 150.42 $ 152.97 $ 155.57 $ 158.22 54151HACS Cyber Program Manager II $ 165.14 $ 167.95 $ 170.81 $ 173.71 $ 176.66 54151HACS Cyber Program Manager III $ 196.37 $ 199.71 $ 203.10 $ 206.56 $ 210.07 54151HACS Cyber Malware Reverse

Engineer II $ 196.27 $ 199.61 $ 203.00 $ 206.46 $ 209.97

54151HACS Cyber Malware Reverse Engineer III

$ 250.02 $ 254.27 $ 258.60 $ 262.99 $ 267.46

54151HACS Cyber Countermeasures Expert

II

$ 196.27 $ 199.61 $ 203.00 $ 206.46 $ 209.97

54151HACS Cyber Countermeasures Expert

III

$ 250.02 $ 254.27 $ 258.60 $ 262.99 $ 267.46

54151HACS Penetration Tester I $ 169.40 $ 172.28 $ 175.21 $ 178.19 $ 181.22 54151HACS Penetration Tester II $ 196.27 $ 199.61 $ 203.00 $ 206.46 $ 209.97 54151HACS Penetration Tester III $ 250.02 $ 254.27 $ 258.60 $ 262.99 $ 267.46

LABOR CATEGORY DESCRIPTION

Commercial Job Title: Cyber Application Architect 1 Minimum/General Experience: 2 Functional Responsibility: The Cyber Application Architect may plan, design, develop, redesign or enhance, install, or implement various cyber technology products, or enhance computer programs. This individual applies knowledge of software and programming to develop and test the security of computer systems and produce the necessary outcome for clients. The Application Architect may draft technical white papers to better understand the cyber technology behind them, and to provide instructions that help the client better understand the nature and applications of a specific cyber product.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Application Systems Analyst Minimum/General Experience: 2 Functional Responsibility: The Cyber Application System Analyst may oversee the implementation of required hardware and software security components for approved applications, coordinates security tests of the application system to ensure proper performance, and develops diagrams and flowcharts for computer programmers to follow.

This individual previews, analyzes, and modifies programming systems, including encoding, debugging, and installing security measures to support an organization's application systems. The Cyber Application System Analyst develops application specifications, identifies the required inputs, and formats the output to meet user's needs.

Commercial Job Title: Cyber Enterprise Architect Minimum/General Experience: 4 Functional Responsibility: The Cyber Enterprise Architect works with stakeholders, both leadership and subject matter experts, to build a holistic view of the organization's strategy, processes, information, and information technology assets to ensure that the business and IT are in alignment and protected from cyber threats. The Cyber Enterprise Architect links the business mission, strategy, and processes of an organization to its IT strategy -including security, and documents this using multiple architectural models or views that show how the current and future needs of an organization will be met in an efficient, sustainable, agile, secure, and adaptable manner.

Commercial Job Title: Cyber Operations Manager

Functional Responsibility: The Cyber Operation Manager manages, coordinates, or organizes department cyber operation strategies and activities. The Operation Manager may: collaborate in the development and implementation of organization cyber policies, practices, procedures, and attainment of operating goals; review, analyze, and prepare reports, records, and directives, and confers with managers/supervisors to obtain data required for planning activities, such as new commitments, status of work in progress, and problems encountered; and, disseminate policies and objectives to supervisors/staff.

Commercial Job Title: Cyber Program Analyst

Functional Responsibility: The Cyber Program Analyst analyzes and critiques existing computer programs and systems security measures, and develops new measures. The program analyst may: review users’ requests for new or modified computer programs to determine feasibility, cost and time required, compatibility with current system, and security capabilities; outline steps required to develop program, using structured security analysis and design;

and, plan, develop, test, and document computer programs, applying knowledge of cyber security, programming techniques, and computer systems.

Commercial Job Title: Cyber Security Specialist 1

Functional Responsibility: The Cyber Security Specialist 1 may identify and resolve highly complex issues to prevent cyber attacks on information systems and to keep computer information systems secure from interruption of service, intellectual property theft, network viruses, data mining, financial theft, and theft of sensitive customer data, allowing business to continue as normal. This is accomplished through the systematic implementation of a cyber framework and process. The Cyber Security Specialist designs, installs, and manages security mechanisms that protect networks and information systems against hackers, breaches, viruses, and spyware. This individual responds to incidents, investigates violations, and recommends enhancements to plug potential security gaps. Level 1 performs more routine aspects of the position and is supervised by higher levels.

Commercial Job Title: Cyber Security Specialist 2

Functional Responsibility: The Cyber Security Specialist 2 may identify and resolve highly complex issues to prevent cyber attacks on information systems and to keep computer information systems secure from interruption of service, intellectual property theft, network viruses, data mining, financial theft, and theft of sensitive customer data, allowing business to continue as normal. This is accomplished through the systematic implementation of a cyber framework and process. The Cyber Security Specialist designs, installs, and manages security mechanisms that protect networks and information systems against hackers, breaches, viruses, and spyware. This individual responds to incidents, investigates violations, and recommends enhancements to plug potential security gaps. Level 2 performs more varied and difficult tasks compared to Level 1, yet has less autonomy than Level 3.

Commercial Job Title: Cyber Security Specialist 3 Minimum/General Experience: 8 Functional Responsibility: The Cyber Security Specialist 3 may identify and resolve highly complex issues to prevent cyber-attacks on information systems and to keep computer information systems secure from interruption of service, intellectual property theft, network viruses, data mining, financial theft, and theft of sensitive customer data, allowing business to continue as normal. This is accomplished through the systematic implementation of a cyber framework and process. The Cyber Security Specialist designs, installs, and manages security mechanisms that protect networks and information systems against hackers, breaches, viruses, and spyware. This individual responds to incidents, investigates violations, and recommends enhancements to plug potential security gaps. Level 3 is competent in subject matter and concepts and generally considered a specialist in area of assignment. May lead individuals assisting in the work.

Commercial Job Title: Cyber Subject Matter Authority (SMA) 1

Functional Responsibility: Recognized as an authority in a given domain of Cyber security, or proficient in highly demanded emergent cyber tools or processes required under special circumstances. Duties may include: applying subject matter authority to a specific incident, security application or enterprise environment to improve security posture or resolve organizational issues.

Commercial Job Title: Cyber Subject Matter Authority (SMA) 2 Minimum/General Experience: 12 Functional Responsibility: Recognized as an authority in a given domain of Cyber security, or proficient in highly demanded emergent cyber tools or processes required under special circumstances. Duties may include: applying subject matter authority to a specific incident, security application or enterprise environment to improve security posture or resolve organizational issues; and, generating issue papers and reporting.

Commercial Job Title: Cyber Subject Matter Authority (SMA) 3 Minimum/General Experience: 16 Functional Responsibility: Recognized as an authority in a given domain of Cyber security, or proficient in highly demanded emergent cyber tools or processes required under special circumstances. Duties may include: applying subject matter authority to a specific incident, security application or enterprise environment to improve security posture or resolve organizational issues; generating issue papers and reporting; and, advising senior leadership on security issues.

Commercial Job Title: Cyber Technical Architect 1

Functional Responsibility: The Cyber Technical Architect 1 provides thought leadership related to current and future customer plans with regard to protecting customer information technology from cyber threats. This individual possesses knowledge of the future direction and trends associated with the stated information technology and is up to date with current threats associated with it. This individual is experienced in designing and implementing protections for information architecture solutions for the stated information technology. This individual designs secure architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

Commercial Job Title: Cyber Technical Architect 2

Functional Responsibility: The Cyber Technical Architect 2 provides thought leadership related to current and future customer plans with regard to protecting customer information technology from cyber threats. This individual possesses knowledge of the future direction and trends associated with the stated information technology and is up to date with current threats associated with it. This individual has experience in designing and implementing protections for information architecture. This individual designs secure architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Training Specialist Minimum/General Experience: 4 Functional Responsibility: The Cyber Training Specialist develops teaching outlines and determines instructional methods, using knowledge of specific training needs and effectiveness of such methods as individual training, group instruction, lectures, demonstrations, conferences, meetings, or workshops. This individual prepares, organizes and heads training sessions covering standard training, specialized training or counseling in designated areas.

Commercial Job Title: Incident Response Analyst 1

Functional Responsibility: Contributes to generating response to crisis or urgent situations to mitigate immediate and/or potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Duties may include: handle and respond to cyber security incidents through coordination with stakeholders such as internal IT entities, security leadership, legal affairs, internal affairs, law enforcement, and privacy offices; intake incident reporting, conduct ticket updates, and notify stakeholders of cyber security incidents and forensic investigations in relation to computer security incidents and escalate when necessary as well as coordinate response to computer security incidents;

recommend a course of action on each incident and creates, manages, and records all actions taken and serve as initial POC for Events of Interest reported both internally and externally; establishes alarm/incident escalation process and tracks, follows-up, and resolves incidents; and, initiates and maintains contact with affected parties during incident response lifecycle. Investigates potential incidents/intrusions.

Commercial Job Title: Incident Response Analyst 2

Functional Responsibility: Contributes to generating responses to crisis or urgent situations to mitigate immediate and/or potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Duties may include: provides oversight for incident data flow and response, content, and remediation, and partners with other incident response centers in maintaining an understanding of threats, vulnerabilities, and exploits that could impact networks and assets; performs real-time proactive event investigation on various security enforcement systems, such as SIEM, Anti-virus, Internet content filtering/reporting, malcode prevention, Firewalls, IDS & IPS, Web security, anti-spam, etc; performs the role of Incident Coordinator for IT Security events requiring focused response, containment, investigation, and remediation; performs forensic analysis on hosts supporting investigations; and, conducts malware analysis in out-of-band environment (static and dynamic), including complex malware.

Commercial Job Title: Incident Response Analyst 3

Functional Responsibility: Contributes to generating responses to crisis or urgent situations to mitigate immediate and / or potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Duties may include: lead shifts and functional IR teams, provides oversight for incident data flow and response, content, and remediation, and partners with other incident response centers in maintaining an understanding of threats, vulnerabilities, and exploits that could impact networks and assets; performs real-time proactive event investigation on various security enforcement systems, such as SIEM, Anti-virus, Internet content filtering/reporting, malcode prevention, Firewalls, IDS & IPS, Web security, anti-spam, etc; performs the role of Incident Coordinator for IT Security events requiring focused response, containment, investigation, and remediation; performs forensic analysis on hosts supporting investigations; conducts malware analysis in out-of-band environment (static and dynamic), including complex malware; coordinate response action to identifies threats and incidents; analyze operational anomalies, network behavior and performs mitigation actions derived from cyber threat monitoring and anomaly analysis, and actively monitors the networks for cybersecurity threats and vulnerabilities; provide oversight and perform quality assurance on Incident Closures; assist with knowledge management - Standard Operating Procedures and procedural support data.

Commercial Job Title: Risk and Vulnerability Threat Analyst 1

Functional Responsibility: Participate in conduct of controls and security assessments to assess risk of exposure of proprietary data through weaknesses in platforms, access procedures, or forms of access to the organization’s systems and the data contained in them. Duties may include: provides technical support on post event network security logs and trend analysis; uncovers security and compliance violations; associates and correlates IP address related events with specific systems or devices in the IT infrastructure; support development and analysis of system and security documentation; maintain documentation for exceptions to standards.

Commercial Job Title: Risk and Vulnerability Threat Analyst 2

Functional Responsibility: Participates in the conduct of controls and security assessments to assess risk of exposure of proprietary data through weaknesses in platforms, access procedures, or forms of access to the organization’s systems and the data contained in them. Duties may include: develop, document and execute containment strategies;

document and brief the business on remediation options and execute the plan with stakeholders; produce final report and recommendation; coordinate efforts of, and provide timely updates to, multiple business units during response;

performing in-depth analysis in support of incident response operations; develop requirements for technical capabilities for cyber incident management; investigate major breaches of security and recommending appropriate control improvements; work with infrastructure and application support teams to drive closure of follow up actions identified through incident and problem management; performs Security Control Assessments on systems to validate the results of risk assessments and ensure controls in the security plan are present and operating correctly on the system; provides thorough report of the risks to the system and its data; and, develop and analyze system and security documentation.

Commercial Job Title: Risk and Vulnerability Threat Analyst 3

Functional Responsibility: Participates in the conduct of controls and security assessments to assess risk of exposure of proprietary data through weaknesses in platforms, access procedures, or forms of access to the organization’s systems and the data contained in them. Duties may include: support engineering design teams by assessing network and system security design features and making recommendations concerning overall security accreditation readiness and compliance and best practices; support interoperability assessment teams and present written analysis and conclusions in all phases of analysis; develop and analyze system and security documentation; follow up with site administrators for status on non-compliant platforms and maintain any necessary exception documentation;

maintain documentation for exceptions to standards; participate in Security Control Assessments on systems to validate the results of risk assessments and ensure controls in the security plan are present and operating correctly on the system; provides thorough report of the risks to the system and its data; and, evaluate system findings, develop PO&AMs, and briefed stakeholders on key findings, recommendations, risk, and impact.

Commercial Job Title: Security Operations Center (SOC) Analyst 1 Minimum/General Experience: 0 Functional Responsibility: Provide cyber threat analysis and reporting to support SOC and Program’s situational awareness. Actively monitor security threats and risks. Track investigation results and report on findings. Duties may include: support Security Operations Center and monitors security tools to review and analyze pre-defined events indicative of incidents and provide first tier response to security incidents; follow standard operating procedures for detecting, classifying, and reporting incidents under the supervision of Tier 2 and Tier 3 staff; and, managing cases within incident management systems.

Commercial Job Title: Security Operations Center (SOC) Analyst 2

Functional Responsibility: Provide cyber threat analysis and reporting to support SOC and Program’s situational awareness. Actively monitor security threats and risks. Track investigation results and report on findings. Duties may include: support Security Operations Center and monitors security tools to review and analyze pre-defined events indicative of incidents and provides first tier response to security incidents; monitor network traffic for security events and perform triage analysis to identify security incidents; respond to computer security incidents by collecting, analyzing, preserving digital evidence and ensure that incidents are recorded and tracked in accordance with SOC requirements; work closely with the other teams to assess risk and provide recommendations for improving our security posture; recommend content to detect security events; managing cases within incident management systems; perform network Forensics and deep packet analysis; and, identify countermeasures to detect and prevent security incidents.

Commercial Job Title: Security Operations Center (SOC) Analyst 3

Functional Responsibility: Provide cyber threat analysis and reporting to support SOC and Program’s situational awareness. Actively monitor security threats and risks. Track investigation results and report on findings. Duties may include: support a Security Operations Center and monitors security tools to review and analyze pre-defined events indicative of incidents and provide first tier response to security incidents; lead shifts and functional IR teams, provides oversight and be responsible for event investigation and tracking activities; support Tier 2 operations by monitoring alerts during critical and high volume events; conduct more in-depth analyses of security incidents to identify incidents of compromise; perform intrusion scope and root cause analyses and assist with intrusion remediation, strategy development, and implementation; recommend effective process changes to enhance defense and response procedures; use SOC monitoring devices to review and analyze pre-defined events indicative of incidents, create and recommend content to detect security events; conduct malware analysis in out-of-band environment (static and dynamic), including complex malware; vet IOCs and intelligence vetting and disposition, assess feed viability; perform network Forensics and deep packet analysis; identify countermeasures to detect and prevent security incidents.; and, support knowledge management and developing procedures and policies for initial stand up of a security operations center (SOC).

Commercial Job Title: Vulnerability Assessment Analyst 1

Functional Responsibility: May support in part or in whole technical vulnerability assessments of applications and infrastructure, vulnerability research, and generation of assessment reports. Duties may include: executes tests by following the steps and procedures listed in a test plan and documents results in a standardized format that is appropriate for future analyses; assists in the coordination of technical tests, network scans, and/or vulnerability scans that support the evaluation of information safeguard effectiveness; conduct reconnaissance data gathering and vulnerability research; and, assists in the creation of risk and vulnerability reporting.

Commercial Job Title: Vulnerability Assessment Analyst 2 Minimum/General Experience: 4 Functional Responsibility: May support in part in in whole technical vulnerability assessments of applications and infrastructure, vulnerability research, and generation of assessment reports. Duties may include: supports development of and follows general test and evaluation plans to compare current and proposed technologies;

assesses test results to determine whether they match requirements specification; assists in the coordination of technical tests, network scans, and/or vulnerability scans that support the evaluation of information safeguard effectiveness; conduct reconnaissance, target assessment, data gathering and vulnerability research; leverages COTS tools to conduct vulnerability assessments, analyzes results, identifies exploitable vulnerabilities, and verifies vulnerabilities; and, prepares report documents by tailoring technical information and creates benchmark or security authorization reports; outlines key findings related to speed, risks, results and reliability, and recommends acceptance or rejection of technology for applied use.

Commercial Job Title: Vulnerability Assessment Analyst 3

Functional Responsibility: May support in part or in whole technical vulnerability assessments of applications and infrastructure, vulnerability research, and generation of assessment reports. Duties may include: contributes to the selection of appropriate technical tests, network or vulnerability scan tools, and/or pen testing tools based on review of requirements and purpose; lists all steps involved for executing selected test(s) and coaches others in the use of advanced research, development, or scan tools and the analysis of comparative findings between proposed and current technologies; coordinates or leads teams to conduct technical tests, network scans, and/or vulnerability scans that support the evaluation of information safeguard effectiveness; conduct reconnaissance, target assessment, target selection, and vulnerability research; using COTS tools, conduct or leads teams to conduct vulnerability assessments, analyzes results, identifies exploitable vulnerabilities, and verifies vulnerabilities through manual assessment; and, prepares and reviews assessment documents, validates and communicates key findings to stakeholders.

Commercial Job Title: Cyber Security Analyst I

Functional Responsibility: Cyber Security Analyst I will have a basic understandings of concepts and terms related access control systems; cryptography; security architecture; operations security; applications security and systems development; statutory and regulatory compliance; forensics, investigations, or security ethics. The Cyber Security Analyst I will assist in penetration testing, incident response and cyber hunt activities as well as systems certification and accreditation projects, including the development of system documentation, system hardening, safeguard implementation, vulnerability assessments, and risk analysis. They will assist with the management and administration of enterprise security programs.

Commercial Job Title: Cyber Security Analyst II

Functional Responsibility: Cyber Security Analyst II supports development of technical solutions to support client’s requirements in solving moderately complex network, platform, and system security problems. They will assist with the management and administration of enterprise security programs. Responsibilities include: assisting with incident response, cyber hunt activities, penetration testing, cyber system engineering, development, and monitoring. Cyber Security Analyst II will also conduct security control assessments with cyber security stakeholders, collect and review artifacts and evidence for compliance with security controls, and document assessment results in a security assessment report and risk assessment report.

Commercial Job Title: Cyber Security Analyst III

Functional Responsibility: Cyber Security Analyst III is responsible for providing customer support in solving all phases of complex cyber security related technical problems. Reviews and recommends cyber security solutions to customer problems based on an understanding of systems test results. Conducts security control assessments with cyber security stakeholders, collect and review artifacts and compile a body of evidence for compliance with security controls, and document assessment results in a security assessment report and risk assessment report.

Particular attention placed on Guard, Firewall, host and network Intrusion Detection/Protection Systems, Penetration Testing, Cyber Hunt activities, Risk and Vulnerability Assessments.

Commercial Job Title: Cyber Security Engineer I

Functional Responsibility: Participate in special projects or investigations into specific technology or solution issues and research and piloting of new technologies. Serve as a point of contact for engineering efforts while assisting in maintaining compliance with the customer's policies and guidelines. Duties may include: provide administrative support to enterprise security devices; provide support of various applications and implement security standards;

and, assist with configuration, validate secure complex systems, and test security products and systems to detect security weakness. Cyber Security Engineer I develops cyber security systems assurance programs and control guidelines. Capable of performing vulnerability scans of networks, providing technical evaluations, identifying risks and proposing mitigation strategies, conducting system-specific tests and evaluations in realistic network configurations to validate secure operational capabilities and/or discover vulnerabilities, performing residual risk analysis to support system assessment and authorization.

Minimum Education: Bachelor’s Degree Commercial Job Title: Cyber Security Engineer II Minimum/General Experience: 4 Functional Responsibility: Participate in special projects or investigations into specific technology or solution issues and research and piloting of new technologies. Serve as a point of contact for engineering efforts while maintaining compliance with the customer's policies and guidelines. Duties may include: configure and maintain policies;

maintain documentation for exceptions to standards; provides timely and adequate response to threats/alerts; assess security events to drive to a resolution; provides timely and sufficient response to security incidents and assessment services; and, promotes security awareness. Cyber Security Engineer II develops cyber security systems assurance programs and control guidelines. Capable of performing vulnerability scans of networks, providing technical evaluations, identifying risks and proposing mitigation strategies, conducting system-specific tests and evaluations in realistic network configurations to validate secure operational capabilities and/or discover vulnerabilities, performing residual risk analyses to support system certification and accreditation. Insures that solutions are fully compatible with or engineered into the customer’s network design.

Commercial Job Title: Cyber Security Engineer III

Functional Responsibility: Participate in special projects or investigations into specific technology or solution issues and research and piloting of new technologies. Serve as a point of contact for engineering efforts while maintaining compliance with the customer's policies and guidelines. Duties may include: configure and maintain policies;

maintain documentation for exceptions to standards; provides timely and adequate response to threats/alerts; assess security events to drive to a resolution; provides timely and sufficient response to security incidents and assessment services; and, promotes security awareness. Cyber Security Engineer III conducts systems security analysis and implementation, system engineering, electrical design, design assurance, testing, security software engineering, program design, configuration management, integration, and testing of cyber security products and techniques.

Commercial Job Title: Cyber Project Manager I Minimum/General Experience: 3 Functional Responsibility: Responsible for small projects or portions of medium projects, keeps the Program Manager abreast of all problems and accomplishments. Leads team on small projects or significant segment of medium complex projects. Translate customer requirements into formal agreements and plans to culminate in customer acceptance of results or have acceptance in the targeted market, while meeting business objectives. Works with client to identify business requirements and develops the proposal. Subsequently leads a team in the initiating, planning, controlling, executing, and closing tasks of a project or segment of a project to produce the solution deliverable. Executes a range of process activities beginning with the request for proposal through development, test and final delivery. Formulates partnerships between customer, suppliers and staff. Anticipates potential project related problems. Utilizes techniques for identifying, eliminating or mitigating solution, project and business risk.

Understands customer, industry and business trends. Applies this understanding to meet project objectives.

Commercial Job Title: Cyber Project Manager II Minimum/General Experience: 5 Functional Responsibility: Responsible for and leads team on small and medium complex projects keeps the Program Manager abreast of all problems and accomplishments. Translates customer requirements into formal agreements and plans to culminate in customer acceptance of results or have acceptance in the targeted market, while meeting business objectives. Works with client to identify business requirements and develops the proposal.

Subsequently leads a team in the initiating, planning, controlling, executing, and closing tasks of a project or segment of a project to produce the solution deliverable. Executes a wide range of process activities beginning with the request for proposal through development, test and final delivery. Formulates partnerships between customer, suppliers and staff. Anticipates potential project related problems. Utilizes refined techniques for identifying, eliminating or mitigating solution, project and business risk. Understands customer, industry and business trends.

Applies this understanding to meet project objectives.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Project Manager III Minimum/General Experience: 8 Functional Responsibility: Serves as project manager for a large, complex task order (or a group of task orders affecting the same common/standard/migration system) and shall assist the Program Manager in working with the ordering activity Contracting Officer (CO), the contract-level Contracting Officer’s Representative (COR), the task order-level COR(s), ordering activity management personnel and customer agency representatives. Under the guidance of the Program Manager, responsible for the overall management of the specific task order(s) and ensuring that the technical solutions and schedules in the task order are implemented in a timely manner. Performs enterprise wide horizontal integration planning and interfaces to other functional systems.

Commercial Job Title: Cyber Program Manager I Minimum/General Experience: 3 Functional Responsibility: Cyber Program Manager I oversees multiple small projects. Possesses high knowledge of business processes. Responsible for performance, cost, scope, schedule, quality, and appropriate business measurements for projects, according to their project charter. Has professional knowledge of market segment/industry/technology/discipline trends. Anticipates future customer, industry, and business trends. Applies this understanding to complex problems to meet project objectives. As appropriate, challenges the validity of given procedures and processes with a view toward enhancement or improvement. Analyzes information and situations and implement actions, independently and or through the management team to ensure project objectives are met.

Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components.

Commercial Job Title: Cyber Program Manager II

Functional Responsibility: Cyber Program Manager II oversees multiple small to medium projects. Possesses high knowledge of business processes. Responsible for performance, cost, scope, schedule, quality, and appropriate business measurements for projects, according to their project charter.

Has professional knowledge of market segment/industry/technology/discipline trends. Anticipates future customer, industry, and business trends. Applies this understanding to complex problems to meet project objectives. As appropriate, challenges the validity of given procedures and processes with a view toward enhancement or improvement. Analyzes information and situations and implement actions, independently and or through the management team to ensure project objectives are met. Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components.

Commercial Job Title: Cyber Program Manager III

Functional Responsibility: Cyber Program Manager III oversees multiple medium complex projects. Possesses expert knowledge of business processes. Responsible for performance, cost, scope, schedule, quality, and appropriate business measurements for projects, according to their project charter. Has extensive professional knowledge of market segment/industry/technology/discipline trends. Anticipates future customer, industry, and business trends. Applies this understanding to complex problems to meet project objectives. As appropriate, challenges the validity of given procedures and processes with a view toward enhancement or improvement.

Analyzes information and situations and implement actions, independently and or through the management team to ensure project objectives are met. Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components.

Commercial Job Title: Cyber Malware Reverse Engineer II

Functional Responsibility: Assists in investigating potential intrusions and security events to contain and mitigate incidents. Research cyber-attacks, malware, and threat actors to determine potential impact and develop remediation guidance; validate, categorize and investigate escalated cyber security events; profile and trend events in the environment for potential incidents; collect, assess and catalogue threat indicators; perform malware analysis. Works under general supervision and usually reports to a supervisor, though some ingenuity and flexibility is required.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Malware Reverse Engineer III Minimum/General Experience: 8 Functional Responsibility: Investigate potential intrusions and security events to contain and mitigate incidents.

Research cyber-attacks, malware, and threat actors to determine potential impact and develop remediation guidance;

validate, categorize and investigate escalated cyber security events; profile and trend events in the environment for potential incidents; collect, assess and catalogue threat indicators; perform malware analysis. Works under general supervision and usually reports to a supervisor, though some ingenuity and flexibility is required.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Countermeasures Expert II Minimum/General Experience: 4 Functional Responsibility: Assist with the management and administration of enterprise security programs. Help design and develop countermeasures using advanced knowledge of cyber threats tools, techniques, and processes.

Operates with a high level of oversight.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Cyber Countermeasures Expert III Minimum/General Experience: 8 Functional Responsibility: Assist with the management and administration of enterprise security programs.

Designing and develop countermeasures; using expert knowledge of cyber threats tools, techniques, and processes, and analytics. Develop software and systems to support the analytics, systems, network, and database. Operates with minimum level of oversight.

Commercial Job Title: Penetration Tester I Minimum/General Experience: 2

Functional Responsibility: Finds security vulnerabilities in target systems, networks, and applications in order to help enterprises improve their security. Works under immediate supervision and usually reports to a supervisor.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Penetration Tester II Minimum/General Experience: 4 Functional Responsibility: Finds security vulnerabilities in target systems, networks, and applications in order to help enterprises improve their security; identification of flaws to cause business risk, a successful candidate provides crucial insights into the most pressing issues and suggests how to prioritize security resources. Works under general supervision and usually reports to a supervisor, though some ingenuity and flexibility is required.

Minimum Education: Bachelor’s Degree

Commercial Job Title: Penetration Tester III Minimum/General Experience: 8 Functional Responsibility: Leads the effort in small projects to find security vulnerabilities in target systems, networks, and applications in order to help enterprises improve their security; leads the identifying of which key flaws can be exploited to cause business risk, a successful candidate provides crucial insights into the most pressing issues and suggests how to prioritize security resources.

54151S IT PROFESSIONAL SERVICE

PRICE SHEET

Price Offered to GSA (including IFF)

SIN Labor Category Year 1 Year 2 Year 3 Year 4 Year 5 54151S Program Manager I $ 165.18 $ 167.99 $ 170.84 $ 173.75 $ 176.70 54151S Program Manager II $ 196.41 $ 199.75 $ 203.15 $ 206.60 $ 210.11 54151S Program Manager III $ 257.09 $ 261.46 $ 265.90 $ 270.42 $ 275.02 54151S Project Manager I $ 165.18 $ 167.99 $ 170.84 $ 173.75 $ 176.70 54151S Project Manager II $ 196.41 $ 199.75 $ 203.15 $ 206.60 $ 210.11 54151S Project Manager III $ 257.09 $ 261.46 $ 265.90 $ 270.42 $ 275.02 54151S Information Systems

Security Specialist I $ 179.96 $ 183.02 $ 186.13 $ 189.29 $ 192.51

54151S Information Systems Security Specialist II

$ 204.59 $ 208.07 $ 211.61 $ 215.21 $ 218.86

54151S Information Systems Security Specialist III

$ 234.35 $ 238.33 $ 242.38 $ 246.50 $ 250.69

54151S Computer Systems Security Specialist I

$ 115.68 $ 117.65 $ 119.65 $ 121.68 $ 123.75

54151S Computer Systems Security Specialist II

$ 130.68 $ 132.90 $ 135.16 $ 137.45 $ 139.79

54151S Computer Systems Security Specialist III

$ 179.96 $ 183.02 $ 186.13 $ 189.29 $ 192.51

54151S Systems Security Architect I $ 125.75 $ 127.89 $ 130.06 $ 132.28 $ 134.52 54151S Systems Security Architect II $ 158.57 $ 161.27 $ 164.01 $ 166.80 $ 169.63 54151S Systems Security Architect III $ 188.86 $ 192.07 $ 195.33 $ 198.65 $ 202.03 54151S Systems Engineer I $ 130.18 $ 132.40 $ 134.65 $ 136.94 $ 139.26 54151S Systems Engineer II $ 161.57 $ 164.32 $ 167.11 $ 169.95 $ 172.84 54151S Systems Engineer III $ 204.59 $ 208.07 $ 211.61 $ 215.21 $ 218.86 54151S Systems Programmer I $ 106.04 $ 107.84 $ 109.68 $ 111.54 $ 113.44 54151S Systems Programmer II $ 120.72 $ 122.78 $ 124.86 $ 126.99 $ 129.14 54151S Systems Programmer III $ 152.47 $ 155.06 $ 157.70 $ 160.38 $ 163.10

54151S Systems Analyst I $ 139.64 $ 142.02 $ 144.43 $ 146.89 $ 149.38 54151S Systems Analyst II $ 152.47 $ 155.06 $ 157.70 $ 160.38 $ 163.10 54151S Systems Analyst III $ 188.86 $ 192.07 $ 195.33 $ 198.65 $ 202.03 54151S Programmer I $ 120.72 $ 122.78 $ 124.86 $ 126.99 $ 129.14 54151S Programmer II $ 152.47 $ 155.06 $ 157.70 $ 160.38 $ 163.10 54151S Programmer III $ 186.95 $ 190.13 $ 193.36 $ 196.65 $ 199.99 54151S Network Engineer I $ 130.18 $ 132.40 $ 134.65 $ 136.94 $ 139.26 54151S Network Engineer II $ 161.57 $ 164.32 $ 167.11 $ 169.95 $ 172.84 54151S Network Engineer III $ 204.59 $ 208.07 $ 211.61 $ 215.21 $ 218.86 54151S Network…