SF 30 _ Amend 00002.pdf

Attachment J002 Labor Category Descriptions and Qualifications

Table of Contents

1 LABOR CATEGORY DESCRIPTIONS AND REQUIREMENTS

1.1 PROGRAM MANAGER

1.2 CYBER SECURITY ANALYST

1.3 SUBJECT MATTER EXPERT (PENETRATION TESTING)

1.4 CYBER SECURITY ENGINEER

1.5 INFORMATION SYSTEM SECURITY DEVELOPER

1.6 INFORMATION SYSTEM SECURITY ANALYST

1.7 TECHNICAL WRITER

1.8 CONTRACT TECHNICAL SUPPORT

1.9 ADMINISTRATIVE SUPPORT

2 ALLOWABLE SUBSTITUTIONS

3 CERTIFICATION REQUIREMENTS

3.1 RISK ASSESSMENTS

3.2 PENETRATION TESTING ‐ RED TEAMING

3.3 PENETRATION TESTING ‐ BLUE TEAMING

4 ADDITIONAL CLARIFICATION

FINAL SIR, Cybersecurity Testing – AMENDMENT 00002

693KA8-20-R-00017

1 Labor Category Descriptions and Requirements

This section provides the position descriptions and minimum education, certification, and experience requirements for the labor categories listed in the table below.

Section CLIN Labor Category

1.1 Xx0A1 Program Manager

1.2 Xx0A2 Cyber Security Analyst I

1.2 Xx0A3 Cyber Security Analyst II

1.2 Xx0A4 Cyber Security Analyst III

1.3 Xx0A5 Subject Matter Expert (Penetration Testing) I

1.3 Xx0A6 Subject Matter Expert (Penetration Testing) II

1.4 Xx0A7 Cyber Security Engineer I

1.4 Xx0A8 Cyber Security Engineer II

1.4 Xx0A9 Cyber Security Engineer III

1.5 Xx0A10 Information Systems Security Developer I

1.5 Xx0A11 Information Systems Security Developer II

1.5 Xx0A12 Information Systems Security Developer III

1.6 Xx0A13 Information Systems Security Analyst II

1.6 Xx0A14 Information Systems Security Analyst III

1.7 Xx0A15 Technical Writer

1.8 Xx0A16 Contract Technical Support

1.9 Xx0A17 Administrative Support

1.1 Program Manager

Position Description Minimum Qualifications

Education/Certifications Relevant Experience Specialized experience

Acts as the overall lead, manager and administrator for the contract effort.

Serves as the primary interface and point of contact with Government program authorities and representatives on technical and program/project issues.

Supervises program/project operations by developing procedures, planning and directing execution of the technical, programming, maintenance and administrative support effort and monitoring and reporting progress. Manages acquisition and employment of program/project resources. Manages and controls financial and administrative aspects of the program/project with respect to contract requirements.

Bachelor’s Degree in Computer Science, Mathematics, Engineering, Statistics or Business Administration from an accredited college or university.

Fifteen (15) years experience managing technical programs/projects and supervising staff member activities.

At least three (3) years Government contracting experience within the 15 years relevant experience is required.

Project Management Professional

(PMP)

certification is desired, but not required.

1.2 Cyber Security Analyst

Minimum Qualifications

Level Education Relevant

Experience Specialized experience

Performs assessments of systems and networks within the network environment or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy.

Measures effectiveness of defense-in-depth architecture against known vulnerabilities.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results.

I

Master’s Degree in Cyber Security, Computer Science, Information Technology, Engineering, Mathematics, or Physics and at least one of the risk assessment certifications listed in Section 3.

15 years experience related to the work/responsibilities outlined in the

Position Description

At least 2 years of the relevant experience must be recent, i.e.

performed within the last 3 years

II

Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, Engineering, Mathematics, or Physics and at least one of the risk assessment certifications listed in Section 3.

10 years experience related to the work/responsibilities outlined in the

Position Description

III

Associated Degree in related field and at least one of the risk assessment certifications listed in Section 3.

5 years experience related to the work/responsibilities outlined in the

1.3 Subject Matter Expert (Penetration Testing)

Level Education/

Certifications Relevant

Experience Specialized experience

Performs penetration testing of the ATO NAS security posture to provide detailed analysis and identification of application, system, and network vulnerabilities; gaps in IT security guidance, and assessment of patching/mitigation methodologies.

Acts as Ethical white hat attacker (red teamer) to simulate cyberattacks, and/or Defensive cybersecurity personnel (blue teamer) to harden against simulated attacks.

Develops and prepares penetration testing Rules of Engagement, test plans, and reports.

Provides recommended remediation actions to lower overall risk exposure, as required

Provides technical expertise on penetration testing tools and simulation environment

I

Master’s Degree in Cyber Security, Computer Science, Information Technology, Engineering, Mathematics, or Physics, and

At least one of the Red Teaming certifications Blue Teaming Certifications listed in Section 3.

10 years’ experience related to the work/responsib ilities outlined in the Position

Description

If required, the Government may request additional specialized experience relevant to the environments or system being tested.

At least 2 years of the relevant experience must be recent, i.e.

performed within the last 3 years

II

Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, Engineering, Mathematics, or Physics, and

At least one of the Red Teaming certifications or Blue Teaming Certifications listed in Section 3.

8 years’ experience related to the work/responsib ilities outlined in the Position

1.4 Cyber Security Engineer

Minimum Qualifications

Level Education Relevant

Experience Specialized experience

Conducts software and systems engineering and software systems research to develop new capabilities, ensuring cybersecurity is fully integrated. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems.

I

Master’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics, and at least one of risk assessment certifications listed in Section 3.

15 years’ experience related to the work/responsibilities outlined in the

Position Description

If required, the Government may request additional specialized experience relevant to the environments or system being tested.

At least 2 years of the relevant experience must be recent, i.e.

performed within the last 3 years

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics, and at least one of the risk assessment certifications listed in Section 3.

10 years’ related to the work/responsibilities outlined in the

Position Description

III

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics, and at least one of the risk assessment certifications listed in Section 3.

5 years’ experience related to the work/responsibilities

1.5 Information System Security Developer

Level Education Relevant Experience Specialized experience

Designs, develops, tests, and evaluates information systems throughout the systems development life cycle.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Conceptualizes, designs, procures, and/or builds secure information technology (IT) systems, with responsibility for aspects of system and/or network development.

I

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics.

15 years’ experience work/responsibilities outlined in the Position

Description

If required, the Government may request additional specialized experience relevant to the environments or system being tested.

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Physics.

10 years’ experience work/responsibilities outlined in the Position

Description

III

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Physics, 5 years’ experience work/responsibilities outlined in the Position

1.6 Information System Security Analyst

Level Education Relevant

Experience Specialized Experience

Conceptualizes, designs, procures, and/or builds secure information technology (IT) systems, with responsibility for aspects of system and/or network development.

Develops and conducts tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of systems or elements of systems incorporating IT.

Designs, develops, tests, and evaluates information systems throughout the systems development life cycle.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics.

10 years’ experience related to the work/responsib ilities outlined in the Position Description

If required, the Government may request additional specialized experience relevant to the

III

Bachelor’s Degree in Cyber Security, Computer Science, Information Technology, Engineering, Mathematics, or Physics.

5 years’ experience related to the work/responsib ilities outlined in the Position Description

If required, the Government may request additional specialized experience relevant to the

1.7 Technical Writer

Minimum Qualifications

Education/Certifications Relevant Experience Specialized experience

Plans, develops, organizes, writes and edits operational procedures and manuals.

Researches, develops and documents technical design specifications and tests scripts. Maintains a comprehensive library of technical terminology and documentation. Analyzes documents to maintain continuity of style of content.

Manages updates and revisions to technical literature.

Bachelor’s Degree 10 years’ experience related to the work/responsibilities outlined in the Position Description

If required, the Government may request additional specialized experience relevant to document preparation such as flow diagraming tools, graphics software, etc.

1.8 Contract Technical Support

Minimum Qualifications

Education/Certifications Relevant Experience

Specialized experience

Supports a variety of technical tasks related to the Contract.

Provides logistics, configuration, installation, technical expertise, and troubleshooting support on laptops, applications, software, and other systems used for cybersecurity testing and assessment.

Initiates and tracks the purchase of new hardware and software used for cybersecurity testing/assessments, and maintains a current inventory of all assets.

Attends meetings to analyze, troubleshoot and diagnose hardware problems.

Assists in developing training materials, e.g. quick reference guides, FAQs, etc., and provides training to help users get started or become familiar with hardware and applications.

Associates’ Degree in a technical field of study or

High School degree and a certificate from an accredited institution that is work to be performed

5 years experience work/responsibilities

As required, the Government may add a preference for experience with specific hardware/software

1.9 Administrative Support

Minimum Qualifications

Education/Certifications Relevant Experience Specialized experience

Provides general administrative support necessary for cybersecurity testing activities and deliverables.

Administrative tasks may include maintaining the security testing schedule;

preparing and sending status reports and communications; scheduling and locating meeting resources; assisting with travel arrangements for off-site testing; and preparing reports and presentations.

Bachelor’s Degree

5 years experience work/responsibilities outlined in the Position Description

Within the 5 years of relevant experience, 3 years experience with Microsoft Office suite, e.g.

Word, Excel, Powerpoint is required.

Familiarity with Adobe Acrobat, Microsoft Project, and remote meeting platforms such as Zoom or Microsoft Teams, and is desired, but not required.

2 Allowable Substitutions

A Master's degree in an appropriate discipline will be considered equivalent to two (2) years of relevant experience. A doctoral or Ph.D. degree in an appropriate discipline will be considered equivalent to four

(4) years of relevant experience.

Eight (8) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to a Bachelor's degree.

Two (2) years of relevant experience over and above the minimum experience requirements for the position plus a Bachelor’s degree (or its equivalent) will be considered equivalent to a Master’s degree.

Six (6) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to a Bachelor's degree, when combined with a certification listed in Section 3 or equivalent certification not already required.

Three (3) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to an Associate’s degree.

An accredited bachelor’s or Master’s degree not listed or not considered equivalent will be counted as one

(1) year of relevant experience; an accredited Ph.D. degree not listed or not considered equivalent will be counted as (2) two years of relevant experience.

Five (5) additional years of project management experience will be considered equalivent to a Project Management Professional (PMP) certification.

Any other substitutions for Certification requirements must be submitted for approval by the Government

3 Certification Requirements

3.1 Risk Assessments

One or more of the following certifications are required.

Certified Information Systems Security Professional (CISSP) GIAC Certified Enterprise Defender (GCED) CompTIA Advanced Security Practitioner (CASP) Certified Information Systems Auditor (CISA)

3.2 Penetration Testing - Red Teaming

At least one of the following certifications are required:

Offensive Security Certified Professional (OSCP) Offensive Security Certified Expert (OSCE) Offensive Security Wireless Professional (OSWP) Offensive Security Web Expert (OSWE) Certified Ethical Hacker (CEH) EC-Council Certified Security Analyst (ECSA) Certified Ethical Hacker (CEH) Practical EC-Council Certified Security Analyst (ECSA) Practical Licensed Penetration Tester (LPT) Master Certified Incident Handler (GCIH) Penetration Tester (GPEN) Web Application Penetration Tester (GWAPT) Exploit Researcher and Advanced Penetration Tester (GXPN) Assessing and Auditing Wireless Networks (GAWN)

3.3 Penetration Testing - Blue Teaming

At least one of the following certifications are required.

Certified Network Defender (CND) Certified Network Defense Architect (CNDA) Certified Incident Handler (GCIH) Certified Intrusion Analyst (GCIA) Defending Advances Threats (GDAT) Defensible Security Architecture (GDSA) Certified Enterprise Defender (GCED) GIAC Certified Forensic Analyst

4 Additional Clarification

Relevant experience is experience directly reflecting the work, task or project being evaluated. The nature of the activities, analyses and work products must be very similar or identical to those of the intended project.

The Government may request specialized expertise not listed in the labor category description to fulfill a particular cybersecurity testing requirement. The specialized expertise must fall within the scope of the contract or must be relevant to the work activities described in Sections C.3 and C.4.

Certification is official recognition of professional level expertise. Certification is official recognition by a trade association, industry organization, an industry or trade governance organization, an educational institution, a government agency or department, or a large corporation with a market dominant product.

Certification denotes an advanced level of specific expertise commensurate with advanced educational degrees. Certification may result from work experience, education, training or a combination of these.

All Associates, Bachelors, or graduate degrees must be from an accredited university or college.