Appendix 3 - Labor Categories.docx

Appendix 3. Labor Categories For Functional Area 1 - Oversight and Governance

1. Cybersecurity Policy and Framework Specialist (Junior) Position Description: This role involves developing, publishing, and maintaining the State-wide Cybersecurity Policy Suite Framework, ensuring alignment with Zero Trust architecture, Privacy Principles, and frameworks like NIST CSF 2.0. The specialist will integrate emerging technology risks (e.g., AI, quantum) into policies, develop standard IT contract language incorporating security requirements, and support the establishment of comprehensive privacy policies and guidelines for citizen data.

Education: Bachelor’s degree in computer science, Information Technology, Cybersecurity, Public Administration, or a related field preferred. Relevant certifications such as CISSP, CISM, CIPP/G, or equivalent are highly desirable.

General Experience:

Junior: 1+ years of experience in Information Technology, with at least 1 years focused on cybersecurity, policy development, or compliance.

Specialized Experience:

· Demonstrated experience in developing or implementing major cybersecurity frameworks (e.g., NIST RMF, NIST CSF, ISO 27001).

· Expert-level knowledge of Zero Trust principles and experience integrating them into policy.

· Experience with privacy regulations (e.g., HIPAA, GDPR, CCPA) and developing Privacy Impact Assessments (PIAs).

· (Senior) Proven ability to lead policy development initiatives for a large organization, including stakeholder management and public communication.

2. Cybersecurity Policy and Framework Specialist (Mid) Position Description: This role involves developing, publishing, and maintaining the State-wide Cybersecurity Policy Suite Framework, ensuring alignment with Zero Trust architecture, Privacy Principles, and frameworks like NIST CSF 2.0. The specialist will integrate emerging technology risks (e.g., AI, quantum) into policies, develop standard IT contract language incorporating security requirements, and support the establishment of comprehensive privacy policies and guidelines for citizen data.

Education: Bachelor’s degree in computer science, Information Technology, Cybersecurity, Public Administration, or a related field preferred. Relevant certifications such as CISSP, CISM, CIPP/G, or equivalent are highly desirable.

General Experience:

Mid-Level: 5+ years of experience in Information Technology, with at least 3 years focused on cybersecurity, policy development, or compliance.

Specialized Experience:

· Demonstrated experience in developing or implementing major cybersecurity frameworks (e.g., NIST RMF, NIST CSF, ISO 27001).

· Expert-level knowledge of Zero Trust principles and experience integrating them into policy.

· Experience with privacy regulations (e.g., HIPAA, GDPR, CCPA) and developing Privacy Impact Assessments (PIAs).

· (Senior) Proven ability to lead policy development initiatives for a large organization, including stakeholder management and public communication.

3. Cybersecurity Policy and Framework Specialist (Senior) Position Description: This role involves developing, publishing, and maintaining the State-wide Cybersecurity Policy Suite Framework, ensuring alignment with Zero Trust architecture, Privacy Principles, and frameworks like NIST CSF 2.0. The specialist will integrate emerging technology risks (e.g., AI, quantum) into policies, develop standard IT contract language incorporating security requirements, and support the establishment of comprehensive privacy policies and guidelines for citizen data.

Education: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Public Administration, or a related field. Relevant certifications such as CISSP, CISM, CIPP/G, or equivalent are highly desirable.

General Experience:

Senior-Level: 8+ years of experience in Information Technology, with at least 5 years focused on enterprise-level cybersecurity policy, governance, or compliance in a public sector or highly regulated environment.

Specialized Experience:

· Demonstrated experience in developing or implementing major cybersecurity frameworks (e.g., NIST RMF, NIST CSF, ISO 27001).

· Expert-level knowledge of Zero Trust principles and experience integrating them into policy.

· Experience with privacy regulations (e.g., HIPAA, GDPR, CCPA) and developing Privacy Impact Assessments (PIAs).

· (Senior) Proven ability to lead policy development initiatives for a large organization, including stakeholder management and public communication.

4. GRC Engineer/Risk Management and Automation Analyst (Junior) Position Description: this analyst supports the Risk-based Governance Program, conducting both qualitative and quantitative cybersecurity and privacy risk assessments across State executive agencies. A primary focus is on implementing the Authority to Operate (ATO) process, specifically by identifying, developing, and deploying automation and AI solutions to reduce manual GRC tasks and facilitate ongoing compliance monitoring and management. This role will also contribute to defining metrics, maturity models, and risk registers.

Education: Bachelor's degree in Cybersecurity, Data Science, Information Systems, or a technical field preferred. Certifications such as CRISC, CAP, or equivalent are beneficial.

General Experience:

Junior-Level: 2+ years of experience in IT or cybersecurity, including some exposure to risk assessment methodologies or process automation.

Specialized Experience:

· Practical experience in conducting formal cybersecurity risk assessments and managing risk registers.

· Proficiency in scripting languages (e.g., Python, PowerShell) or utilizing GRC automation tools to streamline compliance and risk processes.

· Familiarity with the ATO process and continuous monitoring concepts.

· Experience with risk quantification methods and reporting on financial or time-based impacts.

5. GRC Engineer/Risk Management and Automation Analyst (Mid) Position Description: this analyst supports the Risk-based Governance Program, conducting both qualitative and quantitative cybersecurity and privacy risk assessments across State executive agencies. A primary focus is on implementing the Authority to Operate (ATO) process, specifically by identifying, developing, and deploying automation and AI solutions to reduce manual GRC tasks and facilitate ongoing compliance monitoring and management. This role will also contribute to defining metrics, maturity models, and risk registers.

Education: Bachelor's degree in Cybersecurity, Data Science, Information Systems, or a technical field preferred. Certifications such as CRISC, CAP, or equivalent are beneficial.

General Experience:

Mid-Level: 4+ years of experience in cybersecurity or IT risk management, with demonstrable experience in process automation or scripting.

Specialized Experience:

· Practical experience in conducting formal cybersecurity risk assessments and managing risk registers.

· Proficiency in scripting languages (e.g., Python, PowerShell) or utilizing GRC automation tools to streamline compliance and risk processes.

· Familiarity with the ATO process and continuous monitoring concepts.

· Experience with risk quantification methods and reporting on financial or time-based impacts.

6. GRC Engineer/Risk Management and Automation Analyst (Senior) Position Description: this analyst supports the Risk-based Governance Program, conducting both qualitative and quantitative cybersecurity and privacy risk assessments across State executive agencies. A primary focus is on implementing the Authority to Operate (ATO) process, specifically by identifying, developing, and deploying automation and AI solutions to reduce manual GRC tasks and facilitate ongoing compliance monitoring and management. This role will also contribute to defining metrics, maturity models, and risk registers.

Education: Master’s degree in Cybersecurity, Data Science, Information Systems, or a technical field preferred. Certifications such as CRISC, CAP, or equivalent are beneficial.

General Experience:

Senior-Level: 6+ years of experience in cybersecurity or IT risk management, with demonstrable experience in process automation or scripting.

Specialized Experience:

· Practical experience in conducting formal cybersecurity risk assessments and managing risk registers.

· Proficiency in scripting languages (e.g., Python, PowerShell) or utilizing GRC automation tools to streamline compliance and risk processes.

· Familiarity with the ATO process and continuous monitoring concepts.

· Experience with risk quantification methods and reporting on financial or time-based impacts.

7. IT Supply Chain Risk Management Specialist (Junior) Position Description: This specialist is responsible for establishing and operating a comprehensive program to assess and manage the cybersecurity and privacy risks associated with third-party service providers and the IT supply chain, particularly those leveraging AI and emerging technologies. The work includes performing vendor security and privacy assessments, ensuring third-party contracts include required security and privacy clauses (e.g., Zero Trust, secure software development practices), and maintaining a register of third-party risks.

Education: Bachelor’s degree in business, Information Security, Supply Chain Management, or a related technical field preferred. Certifications such as CISSP, CTPRP, or equivalent are preferred.

General Experience:

Junior Level: 2+ years of experience in IT, cybersecurity, supply chain management, strategic contracting, or related discipline with at least 1 year focused on vendor management, third-party risk, or IT procurement security.

Specialized Experience:

· Knowledge of Supply Chain Risk Management (SCRM) principles and frameworks (e.g., NIST SP 800-161. 800-171).

· Demonstrated experience performing security and privacy due diligence on third-party vendors, including review of System and Organization Controls (SOC) reports, penetration tests, and security questionnaires.

· Experience negotiating or drafting technical security and privacy contract language.

· Familiarity with the security implications of utilizing cloud services and emerging technologies like AI from third-party providers.

8. IT Supply Chain Risk Management Specialist (Mid) Position Description: This specialist is responsible for establishing and operating a comprehensive program to assess and manage the cybersecurity and privacy risks associated with third-party service providers and the IT supply chain, particularly those leveraging AI and emerging technologies. The work includes performing vendor security and privacy assessments, ensuring third-party contracts include required security and privacy clauses (e.g., Zero Trust, secure software development practices), and maintaining a register of third-party risks.

Education: Bachelor’s degree in business, Information Security, Supply Chain Management, or a related technical field preferred. Certifications such as CISSP, CTPRP, or equivalent are preferred.

General Experience:

Mid-Level: 5+ years of experience in IT, cybersecurity, supply chain management, strategic contracting, or related discipline, with at least 3 years focused on vendor management, third-party risk, or IT procurement security.

Specialized Experience:

· Experience of SCRM principles and frameworks (e.g., NIST SP 800-161, 800-171).

· Demonstrated experience performing security and privacy due diligence on third-party vendors, including review of System and Organization Controls (SOC) reports, penetration tests, and security questionnaires.

· Experience negotiating or drafting technical security and privacy contract language.

· Familiarity with the security implications of utilizing cloud services and emerging technologies like AI from third-party providers.

9. IT Supply Chain Risk Management Specialist (Senior) Position Description: This specialist is responsible for establishing and operating a comprehensive program to assess and manage the cybersecurity and privacy risks associated with third-party service providers and the IT supply chain, particularly those leveraging AI and emerging technologies. The work includes performing vendor security and privacy assessments, ensuring third-party contracts include required security and privacy clauses (e.g., Zero Trust, secure software development practices), and maintaining a register of third-party risks.

Education: Bachelor’s degree in business, Information Security, Supply Chain Management, or a related technical field preferred. Certifications such as CISSP, CTPRP, or equivalent are preferred.

General Experience:

Senior-Level: 7+ years of experience leading or managing an enterprise-level Supply Chain Risk Management (SCRM) or Third-Party Risk Management (TPRM) program.

Specialized Experience:

· Expert-level knowledge of SCRM principles and frameworks (e.g., NIST SP 800-161, 800-171).

· Demonstrated experience performing security and privacy due diligence on third-party vendors, including review of System and Organization Controls (SOC) reports, penetration tests, and security questionnaires.

· Experience negotiating or drafting technical security and privacy contract language.

· Familiarity with the security implications of utilizing cloud services and emerging technologies like AI from third-party providers.

10. Information System Security Officer (Junior) Position Description: The Junior Information Security Officer (ISO I) performs entry-level cybersecurity assessment and compliance support functions under direct supervision. The incumbent assists in evaluating the implementation and effectiveness of security controls, ensuring compliance with NIST SP 800-53, the Risk Management Framework (RMF), and the State of Maryland cybersecurity standards.

The ISO I supports the collection of technical evidence, execution of basic control validations, and documentation of assessment results. This position serves as a training and developmental role, designed to build proficiency in security control assessment, documentation review, and risk communication.

Education: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field preferred. An additional four (4) years of directly related cybersecurity or IT experience, or completion of recognized cybersecurity training programs, may be substituted for the required bachelor’s degree.

General Experience: 0–2 years of professional experience in cybersecurity, information assurance, or IT security operations, with foundational knowledge of information system protection principles and practices.

Specialized Experience:

· Experience assisting with or supporting system security assessments, including evidence collection, documentation review, and compliance tracking.

· Basic understanding of NIST Cybersecurity Framework (CSF), RMF, or CIS Controls. Familiarity with vulnerability scanning tools and interpreting reports.

· Strong written and verbal communication skills to accurately document findings and effectively collaborate with team members and stakeholders.

11. Information System Security Officer (Mid) Position Description: The Mid-Level Information Security Officer (ISO II) performs independent cybersecurity control assessments and risk evaluations to ensure compliance with federal, state, and organizational cybersecurity requirements. The incumbent applies expert judgment to assess, document, and report on the design and operational effectiveness of security controls, prepare Security Assessment Reports (SAR), and develop Plans of Action and Milestones (POA&M) for remediation.

The ISO II supports assigned organizations by validating cybersecurity compliance across systems, identifying risks, and recommending corrective actions. The role requires analytical and technical expertise in applying various frameworks such as NIST RMF, SP 800-53, and SP 800-37, as well as experience in communicating risk-based findings to both technical and executive stakeholders.

Education: Bachelor’s degree in Cybersecurity, Information Systems, or a closely related field. Graduate degree preferred. An additional six (6) years of progressively responsible cybersecurity or IT experience may be substituted for the required bachelor’s degree. Alternatively, an additional four (4) years of such experience combined with a relevant advanced certification (e.g., CISSP, CISM, CAP, or equivalent) may be substituted.

General Experience: 3–7 years of progressively responsible experience in cybersecurity risk management, compliance assessment, or IT system security operations.

Specialized Experience:

· Experience performing or leading security control assessments aligned with NIST SP 800-53 and RMF; authoring SARs, SSPs, and POA&Ms; and validating control effectiveness through interviews, document reviews, and technical testing.

· Proficiency in vulnerability scanning and continuous monitoring processes.

· Excellent written and verbal communication skills, with demonstrated ability to present complex technical information and actionable recommendations confidently to diverse audiences, including senior leadership.

12. Information System Security Officer (Senior) Position Description: The Senior Information Security Officer (ISO III) serves as a senior cybersecurity authority responsible for leading, managing, and overseeing comprehensive security control assessments for assigned organizations and systems. The ISO III provides strategic oversight of assessment programs, develops methodologies, and ensures alignment with the State’s Policies and Standards, NIST RMF, the NIST Cybersecurity Framework, and Zero Trust principles.

The ISO III advises leadership on systemic risks, emerging threats, and policy improvements; mentors junior and mid-level staff; and coordinates assessment and authorization processes in collaboration with state, federal, and local partners. This role requires advanced technical, analytical, and leadership capabilities to ensure the integrity, confidentiality, and availability of Maryland’s critical systems. ISO III is responsible for developing and reviewing Security Assessment Reports (SARs), managing remediation efforts through Plans of Action and Milestones (POA&Ms), and mentoring junior and mid-level ISOs. This position collaborates with senior leadership across assigned organizations to shape cybersecurity strategy, enhance program maturity, and strengthen resilience against evolving threats.

Education: Bachelor’s degree in Cybersecurity, Information Assurance, Information Systems, or a closely related field. A graduate degree in Cybersecurity, Public Administration, or Technology Management is strongly preferred. An additional eight (8) years of progressively responsible cybersecurity or IT experience may be substituted for the required bachelor’s degree. Alternatively, six (6) years of such experience combined with a relevant advanced certification (e.g., CISSP, CISM, CISA, CGEIT, or equivalent) may be substituted.

General Experience: 8+ years of progressively responsible experience in cybersecurity compliance, governance, and risk management, including demonstrated leadership in cybersecurity program execution or assessment functions.

Specialized Experience:

· Extensive experience planning, leading, and reviewing security control assessments and enterprise risk evaluations aligned with NIST SP 800-53 and RMF.

· Proven expertise in developing, reviewing, and maintaining SARs, SSPs, POA&Ms, and other compliance documentation.

· Demonstrated proficiency in vulnerability management, threat modeling, and continuous monitoring processes.

· Experience advising executive leadership and coordinating with cross-functional teams, including legal, audit, and IT operations.

· Exceptional written and verbal communication skills, with the ability to translate technical and operational risk into strategic recommendations for senior decision-makers.

13. Security Control Assessor (Mid) Position Description: The Mid-Level Security Control Assessor (SCA II) conducts independent assessments of security controls to determine their effectiveness and compliance with established cybersecurity policies, standards, and frameworks. The SCA II performs detailed evaluations of implemented safeguards across networks, systems, and applications.

The incumbent exercises analytical judgment to identify control deficiencies, residual risks, and vulnerabilities, developing comprehensive assessment documentation including Security Assessment Reports (SARs) and POA&Ms. The SCA II contributes to risk management decisions by communicating findings to system owners, program managers, and executive leadership, and provides recommendations for remediation or risk mitigation.

Education: Graduate degree in Cybersecurity, Information Assurance, or a related discipline preferred. Preferred certifications include CISSP, CISM, CAP, or equivalent.

General Experience: 5+ years of progressively responsible experience in cybersecurity compliance, risk assessment, or information assurance. Demonstrated ability to conduct technical evaluations and interpret assessment results.

Specialized Experience:

· Experience leading or performing comprehensive control assessments aligned with NIST SP 800-53 and RMF; developing SARs, SSPs, and POA&Ms; and validating control implementation through interviews, testing, and evidence collection.

· Proficiency in vulnerability management and continuous monitoring processes.

· Ability to translate complex technical results into clear, actionable recommendations.

14. Security Control Assessor (Senior) Position Description: The Senior Security Control Assessor (SCA III) serves as a senior authority and subject matter expert for statewide cybersecurity control assessment and risk management. The incumbent leads complex assessments of security controls for systems supporting critical functions across assigned organizations and ensures alignment with state, federal, and industry cybersecurity standards.

The SCA III oversees the planning, coordination, and execution of security assessments, validates the sufficiency of implemented safeguards, and ensures consistent application of State Policies and Standards, NIST SP 800-53, SP 800-37, FISMA, and Zero Trust principles. This position provides strategic guidance to leadership on authorization decisions, systemic risk trends, and policy improvements. The SCA III mentors junior assessors, establishes methodologies, and ensures high-quality, evidence-based reporting to inform cybersecurity risk posture at the enterprise level.

Education: Graduate degree preferred in Cybersecurity, Risk Management, or related field. Preferred certifications include CISSP, CISM, CRISC, or equivalent advanced-level credential.

General Experience: 8+ years of progressively responsible experience in cybersecurity control assessment, risk management, and compliance. Demonstrated leadership experience in managing enterprise security assessment or authorization programs.

Specialized Experience:

· Extensive experience leading security control assessments and continuous monitoring programs across complex organizations; deep understanding of NIST RMF, SP 800-53, SP 800-37, FISMA, and Zero Trust architectures.

· Proven ability to develop and implement assessment methodologies, interpret complex risk data, and present recommendations to senior executives.

15. Privacy Specialist (Junior) Position Description: A highly motivated and detail-oriented individual who supports the Agency’s privacy program via the implementation, maintenance, and adherence to the agency’s privacy program, including compliance with privacy laws, regulations, and principles such as MD Protection of Information in Government Act, Public Information Act, HIPAA, Fair Information Principles, and other emerging data protection laws. The ideal candidate has a foundational understanding of data privacy principles and a strong desire to grow their expertise in this dynamic field.

Education: Associate of Arts or Bachelor's degree in Law, Information Technology, Business, or a related field preferred. 0–2 years of relevant experience in a compliance, legal, or technology environment. Foundational knowledge of key data privacy concepts (e.g., lawful basis, data minimization, consent management).

General Experience: Possess exceptional attention to detail and strong organizational skills. Excellent written and verbal communication skills, capable of explaining complex compliance issues clearly, and graphically. Proficiency in Office Suite (Word, Excel, PowerPoint), SharePoint, project management tools, database management or similar workplace productivity tools.

Specialized Experience:

· Maintain and update privacy policies, procedures, and internal documentation. Manage, coordinate, and document privacy incident responses and data subject requests within statutory timelines.

· Support the development and delivery of internal privacy training materials and communication programs to ensure organization-wide awareness of privacy best practices. Administratively manage privacy related documents such as data use agreements, personal information inventories, privacy impact assessments, etc.

· Maintain accurate and accessible records of privacy-related activities, decisions, and exceptions using internal tracking systems.

16. Privacy Specialist (Mid) Position Description: The Privacy Specialist (Mid) provides essential administrative, logistical, operational and project management support to the organization's Privacy Program, ensuring the smooth execution of daily privacy operations, compliance tasks, and program initiatives. The position assists in managing privacy documentation, tracking regulatory changes, coordinating privacy-related projects (like Privacy Impact Assessments (PIAs)), data mapping, scheduling and assisting in meetings and training sessions, and privacy program and incident data management, analytics, and reports. Generally, this position supports the Agency Privacy or Data Officer to maintain the program's efficiency, effectiveness and organization. The ideal candidate is highly organized, detail-oriented, possesses strong communication skills, and has a foundational understanding of data privacy concepts.

Education: This position requires an associate or bachelor’s degree in a relevant field such as Business Administration, Paralegal Studies, Information Technology, or related discipline. Certified Information Privacy Professional (CIPP-US) or Manager (CIPM), or related privacy training, a plus.

General Experience: Three to five (3-5) years of professional experience in administrative, coordination, compliance support, or related role, with a minimum of (1-2) direct experience supporting data privacy, legal, compliance, or information security programs. Demonstrated experience with document management, record keeping, and utilizing compliance or incident management, project management software (e.g., GRC platforms, Jira, SharePoint). Familiarity with foundational data privacy concepts and regulations (e.g., PI and Sensitive PI, privacy impact assessments, incident management, NIST privacy framework, CSF v2).

17. Privacy Specialist (Senior) Position Description: Privacy Specialist (Senior) is responsible for management, execution, best practices and continuous improvement of the agency’s enterprise-wide Privacy Program. A high-level, contracted position requires deep expertise in data privacy laws, regulations, Privacy Specialist works closely with Legal, IT/Security, Compliance, Data and business units to ensure all processing of personal information/personally identifiable information (PI/PII) adheres to applicable State and federal laws and regulations, and privacy frameworks, such as NIST Privacy Framework, NIST 800-53, Privacy By Design, and ISO/IEC 29100 and 27701.

The Senior Privacy Specialist drives key privacy initiatives, develops and updates privacy policies and procedures, conducts Privacy Impact Assessments (PIAs), oversees privacy incident breach risk analysis and response, and conducts privacy training and awareness programs.

Education: Required Bachelor's degree in a relevant field such as Privacy, Information Technology, Law, Business Administration, or related discipline. Preferred: Master's degree in a related field. Certifications (Highly Preferred): Certified Information Privacy Professional (CIPP-US), Certified Information Privacy Manager (CIPM), Certified Information Systems Security Professional (CISSP) or similar security-focused certification.

General Experience: Requires seven (7) years of progressive professional experience in data privacy, compliance, information security, or a related regulatory field with a minimum of five (5) years specifically managing and leading a formal, enterprise-level privacy program or complex privacy initiatives.

Specialized Experience:

· The proposed candidate must possess expert-level knowledge and practical experience implementing major privacy laws and frameworks (e.g., NIST Privacy Framework, CSF and/or 800-53 v5, sectoral regulations, ISO 27001/27701) with a proven ability to develop, implement, and maintain privacy policies, standards, and guidelines across a diverse organization.

· A strong background in risk management, including identifying, assessing, and mitigating privacy-related risks in business processes and technology systems, including demonstrated experience conducting and managing Privacy Impact Assessments (PIAs), and privacy incident management and risk reduction.

18. Awareness and Training Specialist (Junior) Position Description: The Junior Training & Awareness Specialist performs entry-level instructional and administrative functions under guided supervision. The primary focus is the delivery and support of the organization’s cybersecurity, privacy, and data governance training initiatives. This role is a "trainer first," responsible for facilitating prepared sessions and assisting in the execution of engagement campaigns. The Junior Specialist supports the creation of short-form awareness content (e.g., newsletters, tip sheets) and helps maintain gamification platforms to drive employee participation. This role serves as a developmental position, building proficiency in adult learning principles, security culture modeling, and role-based training delivery.

Education: Bachelor’s degree in Communications, Education, Cybersecurity, Information Technology, or a related field preferred. Relevant certifications such as CompTIA Security+, SANS Security Awareness Practitioner (SSAP), or equivalent are a plus.

General Experience: 0–2 years of professional experience in training, corporate communications, or IT support, with a foundational interest in cybersecurity and data privacy.

Specialized Experience:

· Experience or strong aptitude for public speaking and delivering presentations to small-to-medium groups.

· Familiarity with digital content creation tools (e.g., Canva, PowerPoint, or basic video editing software) to produce short-form awareness materials.

· Basic understanding of cybersecurity "hygiene" (phishing, password management, PII protection) and data governance concepts.

· Ability to assist in the administration of Learning Management Systems (LMS) or gamified awareness platforms (e.g., leaderboards, badge systems).

· Strong written communication skills for drafting clear, concise internal alerts and educational posts.

19. Awareness and Training Specialist (Mid) Position Description: The Mid-Level Awareness and Training Specialist is responsible for the independent design, delivery, and management of cybersecurity, privacy, and data governance training modules. The incumbent acts as a lead facilitator, translating complex technical requirements into engaging, role-based training for diverse audiences (e.g., executives, HR, developers). This role focuses heavily on modernizing training through gamification strategies and the production of "snackable" short-form content. The Specialist evaluates training effectiveness through metrics and phishing simulations, ensuring that the curriculum evolves to meet emerging threats and regulatory requirements such as NIST 800-50 and the NICE Framework.

Education: Bachelor’s degree in Instructional Design, Cybersecurity, Communications, or a related field. Professional certifications such as SANS SSAP, CIPP/US, or Security+ are preferred.

General Experience: 3–6 years of experience in instructional design, corporate training, or cybersecurity awareness, with at least 2 years specifically focused on security or privacy education.

Specialized Experience:

· Demonstrated experience developing role-based training paths tailored to specific job functions and risk profiles.

· Proven ability to design and implement gamification elements (e.g., escape rooms, competitions, rewards) to increase engagement.

· Proficiency in creating high-quality short-form content, including micro-learning videos, infographics, and interactive modules.

· Experience managing enterprise-wide phishing simulation programs and analyzing behavioral data to identify training gaps.

· Knowledge of privacy frameworks (NIST Privacy Framework) and data governance principles to ensure integrated training delivery.

· Strong project management skills to coordinate awareness month activities and large-scale training rollouts.

20. Awareness and Training Specialist (Senior) Position Description: The Senior Awareness and Training Specialist serves as the strategic lead and architect of the enterprise-wide cybersecurity, privacy, and data governance training program. This role is responsible for building the program from the ground up or maturing existing frameworks to create a high-performance security culture. As a senior "trainer first," they mentor junior staff and deliver high-stakes training to executive leadership. The Senior Specialist defines the strategy for gamification, role-based learning, and short-form content delivery, ensuring all initiatives align with NIST 800-53 (AT controls) and organizational risk posture. They collaborate with Legal, HR, and C-Suite stakeholders to ensure the training program meets compliance mandates and measurably reduces human-centric risk.

Education: Bachelor’s degree required; Graduate degree in Instructional Technology, Cybersecurity, or Organizational Behavior preferred. Advanced certifications such as CISSP, CISM, CIPP/US, or CISA are highly desirable.

General Experience: 7+ years of progressively responsible experience in cybersecurity training, security culture management, or organizational change management, with a proven track record of leading enterprise-level awareness programs.

Specialized Experience:

· Expert-level knowledge of adult learning theories and instructional design methodologies (e.g., ADDIE, SAM) applied to cybersecurity.

· Experience building and scaling a comprehensive Training & Awareness program, including budget management and vendor selection for LMS/gamification tools.

· Expertise in developing strategic communication plans that utilize "short-form" and "just-in-time" learning to influence behavioral change.

· Ability to define and report on Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) to demonstrate the ROI of training to executive leadership.

· Deep understanding of the NICE Framework (Cybersecurity Instruction) and its application in building a skilled workforce.

· Exceptional leadership skills with the ability to influence organizational culture and drive the adoption of data governance and privacy-by-design principles.

21. Cybersecurity Governance Specialist (Junior) Position Description: Provides entry-level support for cybersecurity governance and compliance activities. Assists in the research and documentation of policies, aids in the collection of risk assessment data, and supports the administration of training and awareness programs. Works under direct supervision to ensure alignment with frameworks like NIST CSF 2.0 and the State-wide Cybersecurity Policy Suite.

Education: Bachelor’s degree in Cybersecurity, Public Administration, Information Technology, or a related field preferred.

General Experience: 1–3 years of experience in information technology or cybersecurity.

Specialized Experience:

· Foundational knowledge of cybersecurity frameworks (NIST, ISO) and data privacy principles.

22. Cybersecurity Governance Specialist (Mid) Position Description: Performs independent cybersecurity governance and risk evaluations. Develops and maintains policy documentation, conducts qualitative and quantitative risk assessments, and supports the implementation of the Authority to Operate (ATO) process. Translates regulatory requirements into actionable guidance for State and local agencies.

Education: Bachelor’s degree in Cybersecurity, Public Administration, Information Technology, or a related field.

General Experience: 5+ years of experience in IT, with at least 3 years focused on cybersecurity governance, policy, or compliance.

Specialized Experience:

· Demonstrated experience implementing risk-based programs or automating GRC tasks using scripting or specialized tools.

23. Cybersecurity Governance Specialist (Senior) Position Description: Serves as a senior authority for cybersecurity governance, providing strategic oversight of policy development and enterprise risk management. Leads high-stakes compliance initiatives, advises leadership on emerging threats (e.g., AI or quantum), and coordinates across cross-functional teams including legal, audit, and IT operations.

Education: Bachelor’s degree required; Master’s degree in a related technical or management field preferred.

General Experience: 8+ years of progressively responsible experience in enterprise-level cybersecurity governance, risk management, or compliance.

Specialized Experience:

· Expert-level knowledge of Zero Trust principles and proven ability to lead policy development and stakeholder management for large organizations.

NOTE: The Senior role can also serve as a lead.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

For Functional Area 2 – Architecture, Engineering, and Implementation

1. Cybersecurity Architect (Junior) Position Description: Assists in developing business, data, systems, and infrastructure models to create enterprise-level security architectures. Help develop plans for migrating legacy systems to modern, secure platforms and contributes to the development of technical reference models and hardware/software standards. Works under the guidance of senior architects to engineer integrated hardware and software solutions that meet the State's and organizational mission requirements.

Education: Requires a Bachelor’s degree from an accredited college or university in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field.

General Experience: Must have at least five (5) years of experience in information technology, with at least three (3) of those years in a cybersecurity-focused role.

Specialized Experience: Must have at least two (2) years of experience contributing to the design of security solutions in areas such as network, application, or cloud security. Experience with documenting security designs and familiarity with NIST frameworks is required.

2. Cybersecurity Architect (Mid) Position Description: Performs design of information systems, including the application architecture, database, and interfaces. Gathers and analyzes user requirements and translates them into system designs. Develops and helps execute system designs, ensuring implementation of repeatable processes and compliance with established methodologies. Evaluates system problems of workflow, organization, and planning and develops appropriate corrective action.

Education: A Bachelor’s degree from an accredited college or university in Cybersecurity, Computer Science, Information Systems, Engineering, or a related scientific or technical discipline is preferred.

General Experience: At least seven (7) years of experience planning, designing, building, and implementing IT systems.

Specialized Experience: At least four (4) years of experience analyzing user requirements and translating them into system designs using various design tools and techniques. Must have experience in the direct design and implementation of cybersecurity architectures for enterprise projects.

3. Cybersecurity Architect (Senior) Position Description: Provides expertise in the most current principles and practices of architecture data management systems and experience in large system designs. Leads the development and implementation of a Zero Trust Architecture (ZTA) roadmap for cloud, hybrid, and on-premises environments, ensuring alignment with State, federal, or organizational standards like NIST SP 800-207. Acts as the chief architect in major IT implementation efforts, providing technical guidance, mentoring junior staff, and demonstrating excellence in written and verbal communication.

Education: This position requires a Bachelor’s degree from an accredited college or university in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field. A Master’s degree is preferred.

General Experience: At least ten (10) years of experience planning, designing, building, and implementing IT systems.

Specialized Experience:

· At least seven (7) years of the required experience must be in the direct design and implementation of enterprise-level cybersecurity architectures.

· Must have demonstrated experience leading the architectural design of major IT security projects, with deep expertise in Zero Trust principles, cloud security (AWS, Azure, GCP), and NIST frameworks (e.g., Cybersecurity Framework, SP 800-53).

4. DevSecOps Engineer (Junior) Position Description: Assists in the development, maintenance, and optimization of the software development environment. Helps manage the infrastructure, build, integration, and software deployment process under the guidance of senior engineers. Knows scripting languages such as Ruby and Python.

Education: Bachelor’s degree in Computer Science, Cybersecurity, or area of specialty is preferred.

General Experience: At least two (2) years of relevant experience.

Specialized Experience:

· At least one (1) year of experience working in a DevOps or software development environment with exposure to CI/CD pipelines and automated testing.

5. DevSecOps Engineer (Mid) Position Description: Develops, maintains, and optimizes the software development environment, with a growing focus on integrating security practices. Is responsible for the infrastructure, build, integration, and software deployment process. Works with development teams to implement automated security checks within the CI/CD pipeline. Should know scripting languages such as Ruby and Python.

Education: A Bachelor’s degree in Computer Science, Cybersecurity, or area of specialty is preferred.

General Experience: At least five (5) years of relevant experience.

Specialized Experience:

· At least two (2) years of experience integrating security tools (e.g., SAST, DAST) into CI/CD pipelines.

· Proficient in scripting languages and has experience with infrastructure-as-code and container security.

6. DevSecOps Engineer (Senior) Position Description: Develops, maintains, and optimizes the software development environment with a primary focus on integrating security into the CI/CD pipeline. Champions DevSecOps best practices, focusing on "shifting security left" by integrating automated security tools and processes directly into the software development lifecycle (SDLC) to identify and remediate vulnerabilities early. Is responsible for the security of the infrastructure, build, integration, and software deployment process.

Education: A Bachelor’s degree in Computer Science, Cybersecurity, or a related area of specialty is preferred.

General Experience: At least seven (7) years of relevant experience in either a DevOps or cybersecurity role.

Specialized Experience:

· At least five (5) years of hands-on experience architecting and implementing secure CI/CD pipelines.

· Must be a subject matter expert in scripting languages, infrastructure-as-code, and container security.

7. Cybersecurity Solutions Staff (Junior) Position Description: Assists in developing business, data, systems, and infrastructure models to create secure enterprise architectures. Helps develop plans for migrating legacy systems to modern platforms and documents security designs under the guidance of senior architects.

Education: Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical discipline.

General Experience: At least five (5) years of experience in information technology, with at least three (3) of those years in a cybersecurity-focused role.

Specialized Experience:

· At least two (2) years of experience contributing to the design of security solutions in areas such as network, application, or cloud security.

8. Cybersecurity Solutions Staff (Mid) Position Description: Performs the design of information systems, including application architecture and database interfaces. Gathers and translates user requirements into secure system designs, ensuring compliance with established methodologies and the integration of automated security checks.

Education: Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical discipline.

General Experience: At least seven (7) years of experience planning, designing, building, and implementing IT systems.

Specialized Experience:

· At least four (4) years of experience in the direct design and implementation of cybersecurity architectures for enterprise projects.

9. Cybersecurity Solutions Staff (Senior) Position Description: Acts as the chief architect for major IT implementation efforts, leading the development of a Zero Trust Architecture (ZTA) roadmap for cloud, hybrid, and on-premises environments. Champions DevSecOps best practices and provides expert guidance on secure cloud adoption and architecture.

Education: Bachelor’s degree required; Master’s degree preferred.

General Experience: At least ten (10) years of experience planning, designing, building, and implementing IT systems.

Specialized Experience:

· At least seven (7) years of experience in the direct design and implementation of enterprise-level cybersecurity architectures, with deep expertise in NIST frameworks and cloud security.

NOTE: The Senior role can also serve as a lead.

10. Cybersecurity Engineer (Junior) Position Description: Assists in the implementation, maintenance, and monitoring of cybersecurity solutions across the enterprise. Works under the direction of senior engineers to configure and troubleshoot security tools, respond to security alerts, and perform initial analysis of potential security incidents. Helps maintain system documentation and standard operating procedures.

Education: A Bachelor’s degree from an accredited college or university with a major in Cybersecurity, Computer Science, Information Systems, Engineering, or a related scientific or technical discipline is preferred.

General Experience: At least three (3) years of experience as a software engineer or systems administrator.

Specialized Experience:

· At least one (1) year of experience working directly with security technologies such as firewalls, intrusion detection/prevention systems (IDPS), or endpoint security solutions.

11. Cybersecurity Engineer (Mid) Position Description: Implements, manages, and optimizes cybersecurity solutions that protect organizational information systems. Configures, maintains, and troubleshoots a variety of security platforms, including SIEM, EDR, vulnerability management systems, and network security controls. Provides ongoing cloud infrastructure, system development, and maintenance support, including building new secure systems and resolving issues.

Education: A Bachelor’s degree from an accredited college or university with a major in Cybersecurity, Computer Science, Information Systems, Engineering, or a related scientific or technical discipline is preferred.

General Experience: At least six (6) years of experience in systems engineering or network administration.

Specialized Experience:

· At least three (3) years of experience in the implementation and administration of enterprise security tools.

· Must have demonstrated experience with interactive, real-time systems and security monitoring.

12. Cybersecurity Engineer (Senior) Position Description: Provides technical leadership for the implementation and continuous optimization of cybersecurity solutions and services. Leads complex projects, mentors junior engineers, and serves as a subject matter expert for security engineering and architecture services. Drives the operationalization of Zero Trust architectures and the integration of AI and automation to enhance threat detection and response capabilities.

Education: A Bachelor’s degree from an accredited college or university with a major in Cybersecurity, Computer Science, Information Systems, Engineering, or a related scientific or technical discipline. A Master’s degree is preferred.

General Experience: At least eight (8) years of experience in systems or network engineering.

Specialized Experience:

· At least five (5) years of experience in the supervision of system engineers and management of security engineering projects.

· Must have demonstrated expertise with enterprise-scale security solutions and experience leading the technical response during major cybersecurity incidents.

13. Cloud Security Engineer (Junior) Position Description: Assists in the implementation and monitoring of security controls within the State's cloud environments (e.g., AWS, Azure, GCP). Works under the supervision of senior engineers to configure cloud-native security tools, respond to security alerts, and help enforce security policies.

Education: A Bachelor’s degree from an accredited college or university with a major in computer science, information systems,…