Attachment 3 - Labor Category.pdf

Software DevSecOps Services Attachment 3 - Labor Category

28 October 2019

Labor Category Description Qualifications/Clearance Requirements

DEVSECOPS ENGINEER (PLATFORM

TEAM) Level 1,2,3

The DevSecOps Engineer (Platform Team) is a platform team developer who develops and manages the CI/CD pipelines of a wide variety of applications.

They are “disconnected” from the product teams. Ideally the majority of the DevSecOps platform engineers should be co-located. Considered a "generalist" on CI/CD pipeline and security requirements with strong knowledge of the platform as a whole.

Have a passion for agile and DevSecOps methodologies. Experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications. Working knowledge of source version control, build/release tools and methodologies, and CI/CD pipelines. Working knowledge of Software Build process. A DevSecOps Engineer on the Level Up Platform team should have a passion for building and maintaining CI/CD pipelines for a large Level Up enterprise that consists of hundreds of applications.

Strong "security first" mindset. Ability to attain Secret security clearance.

DEVSECOPS ENGINEER (PRODUCT

TEAM) Level 1,2,3

The DevSecOps Engineer (product team) is a Level Up developer who onboards new products onto a Level Up CI/CD pipeline and works with the product team to maintain them. They are “disconnected” from the platform teams, but do work closely with the platform team to ensure product teams are successful. Strong knowledge of the product being supported as well as the platform. DevSecOps product team engineers should be located at every major Level Up software development shop or

CAMP.

Have a passion for agile and DevSecOps methodologies. Experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications. Working knowledge of source version control, build/release tools and methodologies, and CI/CD pipelines. Working knowledge of Software Build process and a strong "security first" mindset. A DevSecOps Engineer on the Product Support team should have a passion for building and maintaining CI/CD pipelines for multiple product teams and working with the enterprise Level Up. Ability to attain Secret security clearance.

PLATFORM ENGINEER (PLATFORM

TEAM) Level 1,2,3

A platform engineer (production) develops and maintains the production environment (k8s, Openshift, VMWare PKS Essentials, etc…). They ensure a modern and secure foundation upon which all product teams can deploy containerized applications. The majority of the platform engineering team should be co-located.

Have a passion for agile and DevSecOps methodologies. Experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications utilizing docker, k8s, Openshift, etc. Working knowledge of Source Version Control and Build/Release tools and methodologies.

Strong understanding of Software Build process and how it connects to

CI/CD.

Ability to attain Secret security clearance.

PLATFORM ENGINEER (PRODUCT

TEAM) Level 1,2,3

A platform engineer (production) on-boards and helps product teams maintain a production environment (k8s, Openshift, VMWare PKS Essentials, etc…). They are “disconnected” from the platform team, but do work closely with the platform team to ensure product teams are successful. Strong knowledge of the product, the platform and containerization of applications.

Have a passion for agile and DevSecOps methodologies. Experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications utilizing docker, k8s, Openshift, etc. Working knowledge of Source Version Control and Build/Release tools and methodologies.

Working knowledge of Software Build process. Ability to attain Secret security clearance.

IT DEV SUPPORT TEAM Level 1,2,3 The IT development team ensures that all development tools, such as IDEs, repos, desktops, chat tools, etc… are all updated and accessible. Their customer is the developers who are leveraging the Level Up platform.

Have a passion for agile and DevSecOps methodologies. Experienced in providing support to teams of developers. Experienced in testing, and maintaining development tools and applications. Working knowledge of Source Version Control and Build/Release tools and methodologies.

Strong understanding of Software Build process and how it connects to

CI/CD.

Ability to attain Secret security clearance.

IT OPS TEAM Level 1,2,3 The IT operations team is a 24/7 mission support cell that ensures that the Cloud One environment is stable and accessible. Their customer is the operators who are using applications within the Cloud One environment.

Have a passion for DevSecOps methodologies and operational missions.

Experienced in providing support to IT operations, troubleshooting and fixing production applications in multiple environments. Working knowledge of Source Version Control, Build/Release tools and methodologies and Software Build process. Willingness to support 24/7 oncall operations on a rotating basis. Ability to attain Secret security clearance.

SENIOR RELIABILITY ENGINEER

Level 1,2,3

A senior reliability engineer is a senior software developer than ensures that DevSecOps principals are followed through the entire software delivery lifecycle. They cross multiple product teams to get a grasp of a product and/or programs overall state of health. If a product team is in a poor state of health, the medic is responsible for reviving them and bringing them back to a healthy software state. Considered an expert on the CI/CD process and the overall vision of the program.

Have a passion for agile and DevSecOps methodologies. Advanced experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications. Working knowledge of source version control, build/release tools and methodologies, CI/CD pipelines and the Software Build process. A Senior Reliability Engineer on the Level Up Platform team should have a passion and experience in building and maintaining CI/CD pipelines for large enterprises that consists of hundreds of applications. Ability to be flexible and work on several different products while supporting multiple teams. Ability to attain Secret security clearance.

CONTAINER HARDENING ENGINEER

Level 1,2,3

Part of the foundation of DevSecOps is the concept of “hardening” a Docker container. A “hardened” container simply means that the container is stripped of unnecessary software to limit potential vulnerabilities that can be exploited by attackers. A container hardening engineer hardens and maintains the wide variety of software tools and applications required for development and production within the greater DevSecOps community.

Have a passion for agile and DevSecOps methodologies. Advanced experienced in providing DevSecOps implementation using Jenkins, Gitlab, or similar tools. Experienced in developing, testing, and maintaining containerized applications especially with respect to security and vulnerability testing. Working knowledge of source version control, build/release tools and methodologies, CI/CD pipelines and the Software Build process. Strong "security first" mindset. Ability to attain Secret security clearance.

28 October 2019

SECURITY ASSESSMENT Level 1,2,3 Third party reviewers who assess security vulnerabilities. From a physical or cyber perspective.

Have a passion for agile and DevSecOps methodologies. Knowledge of modern security methods and vulnerabilities. Ability to stay up to date on emerging security threats. Experienced in software and security testing, especially with containerized applications. Understanding of physical security threats and countermeasures. Strong "security first" mindset.

Ability to attain Secret security clearance.

CYBERSECURITY Level 1,2,3 Internal members who both actively red and blue team the system as well as provide continuous monitoring of the live cyber environment for all environments in ones control.

Have a passion for agile and DevSecOps methodologies. Experience with running red team/blue team security games and analysis. Understanding of live monitoring of cyber environment for potential attacks, vulnerabilities and log analysis. Development of cybersecurity architecture with ability to adapt quickly to evolving requirements. Ability to attain Secret security clearance.

FORWARD DEPLOY Engineer Level 1,2,3

To setup new software shops it is very common to have to travel for extended periods of time. The forward deploy team are the individuals who work with new organizations wanting to leverage the Level Up platform.

They are expected to travel up to 50% of their time.

Have a passion for agile and DevSecOps methodologies. Working knowledge of source version control, build/release tools and methodologies, CI/CD pipelines and the Software Build process. Strong general understanding of the Level Up platform philosophy and methodology. Ability to be flexible and cultivate relationships with new stakeholders. Willingness to travel up to 50%. Ability to attain a Secret security clearance.

PROJECT MANAGEMENT Level 1,2,3 Agile managers who understand how to manage non-waterfall projects

Responsible development and implementation of assigned projects.

Responsible for the operational planning, establishment, execution, and evaluation of a multifaceted program/project. Responsible for operational, administrative, and human resources management of the program; serves as principal point of representation and liaison with external constituencies on operational matters, and provides day-to-day technical/professional guidance and leadership as appropriate to the area of expertise. Develops detailed work plans, schedules, project estimates, resource plans, and status reports. Conducts project meetings and is responsible for project tracking and analysis. Ensures adherence to quality standards and reviews project deliverables. Manages the integration of vendor tasks and tracks and reviews vendor deliverables. Provides technical and analytical guidance to project team. Recommends and takes action to direct the analysis and solutions of problems. Ability to attain Secret security clearance.

DESIGNER Level 1,2,3 Individuals in charge of both graphics and user interactions ensuring that user centric designed is practiced for all product teams.

Strong interpersonal skills for frequent meetings and interviews with users and stakeholders. Aesthetic sense and experience with graphic arts.

Ability to respond quickly and productively to user requirements and change requests. Ability to translate users requirements into actionable technical guidelines. Ability to attain Secret security clearance.

CLOUD ARCHITECT

Individuals with expertise in design, deployment and management of cloud resources. Cloud architects understand at a deep level the structure and distribution of computing resources in AWS, Azure, etc. Also will prioritize usage to most efficiently allocate funds and resources for the platform.

Have a passion for agile and DevSecOps methodologies. Deep understanding of the design, deployment and management of cloud resources in numerous environments (AWS, Azure, etc.). Ability to prioritize usage to most efficiently allocate resources to maximize developer experience and stay within budget. Knowledge of networking, security groups and policy management in relation to cloud resources.

Respond to product team needs in a timely fashion. Strong "security first" mindset. Ability to attach Secret security clearance.

DATA SCIENTIST Data scientists and engineers design, implement, and maintain a data pipeline

● At least 5 years experience developing in languages commonly used for data analysis such as Python, R, Julia, or SAS

● Experience working with databases such as SQL or MongoDB

● At least 5 years of theoretical and practical background in statistical analysis, machine learning, predictive modeling, and/or optimization.

● At least three years experience developing Reinforcement learning systems utilizing Finite Markov Decision Processes, Support Vector Machines, Q-Learning, Stochastic Finite State Machines, MCTS and other hybrid Deep Reinforcement Learning processes

28 October 2019

HELP DESK SUPPORT SERVICES

Provides support to end-users for PC, server, mainframe applications, and hardware. Handles problems that the first-tier of help desk support is unable to resolve. May interact with network services, software systems engineering, and/or applications development to restore service and/or identify and correct core problem. Simulates or recreates user problems to resolve operating difficulties. Recommends systems modifications to reduce user problems. Maintains currency and highest level of technical skill in field of expertise.

Have a passion for agile and DevSecOps methodologies. Strong communication skills to provide support to end users for PC, server, mainframe applications and hardware. Handles problems that are escalated from IT support staff. Strong experience troubleshooting and resolving problems in a wide range of environments with many applications. Stays up-to-date on current trends and technologies to stay ahead of the curve for future issues. Highly responsive to customer requests. Ability to attain Secret security clearance.

PROGRAMMER/DEVELOPER

Provides programming services for a variety of specific systems and business, military, scientific, or commercial applications. Participates in systems analysis, design definition, software development, systems test, implementation, and maintenance. Analyzes coding problems and develops improvements to procedures. Exercises independent judgment. Designs, develops, troubleshoots, debugs, and implements software code (such as HTML, CGI, and JavaScript) for a component of the website. Could include

Strong experience in several modern languages (JavaScript, Python, HTML, etc.) with expertise to design, develop, troubleshoot, debug and implement high quality code. Experience in a wide variety of computing environments including cloud and containerized solutions. Cultivates a "security first" and "test first" approach to test-driven development.

Ability to attain a Secret security clearance.

NETWORK ENGINEER

Reviews, plans, and evaluates network systems. May troubleshoot network systems and recommend improvements to network. Provides documentation/project tracking and management reporting. Provides tactical and strategic input on overall network planning and related projects.

Familiar with a variety of the field's concepts, practices, and procedures.

Relies on experience and judgment to plan and accomplish goals. Performs a variety of complicated tasks. May lead and direct the work of others. A wide degree of creativity and latitude is expected.

Significant experience with a wide variety of network systems. Design, develop and troubleshoot network systems; recommend improvements to existing infrastructure. Excellent written communication skills to provide detailed documentation. Experience working with cloud and containerized environment. Strong "security first" mindset. Ability to attain a Secret security clearance.

INSTRUCTIONAL TRAINER

Responsible for the creation and development of training for the DevSecOps Environment. Works actively to create and deliver training for DevSecOps. Research, deliver, and develop trainings and materials (Instructor lead and eLearnings). Create engaging learning activities and compelling course content that enhances retention and transfer. Work with subject matter experts and identify target audience s training needs. Apply tested instructional design theories, practice, and methods. Conduct instructional research and analysis on learners and contexts. Utilize a variety of training methodologies and concepts for maximum impact. Writes and updates technical documentation such as user manuals, system documentation, and training materials. Maintains current knowledge of relevant technology as assigned. Participates in special projects as required.

Instructional design with instructional technology as a corporate/company trainer, development of training and planning lessons and curriculums, work in a performance based environment with course development software. Should have experience supporting a Dev Ops environment using a Cloud construct as well as employing Agile Development techniques. Strong leadership and management skills. User of Agile tools such as Atlassain Suite (JIRA, Confluence etc.) or similar products.

Experience with software dev ops and continuous integration and deployment tools. Excellent communication skills for frequent interaction with all levels of executive leadership.

CONSULTANT

Assesses, defines, implements, participates in and supports DevSecOps programs. Engagements span from simple IT projects to large-scale, enterprise-level transformation programs. Collaborate with teams and aid in developing consultative solutions to implement DevSecOps capabilities to enable secure product development. Conduct methodology and architecture security assessments and define solutions to produce tailored DevSecOps platforms inclusive of target state people, process, and technology operating models. Works with program team and end user groups to evaluate and solve technical problems. Evaluates existing systems and/or user needs to analyze, design, recommend, and implement system changes. Provides skills and thorough and/or specialized experience in emerging technologies not normally found in the marketplace. Provides leadership and technical direction to teams. Subject Matter Expert for specialized skills. Determines technical strategy regarding specialized skills.

Essential qualifications includes: experience working in Application Security; experience working in an Agile development environment; and, hands-on experience with DevOps CI/CD tools such as Git, Jenkins, Ant/Maven/Gradle, Nexus/Artifactory, SonarQube, Puppet/Chef/Ansible or similar

Professional skill requirements includes: proven success in contributing to a team-oriented environment; ability to work creatively and analytically in a problem-solving environment; desire to work in an information systems environment; excellent communication (written and oral) and interpersonal skills; able to meet requirements for retaining professional security certifications; and, demonstrated teamwork and collaboration in a professional setting; either military or civilian.

Preferred skills includes: software application development experience, preferably Web application development; experience with Agile and/or DevOps methodologies; experience performing application security assessments such as threat modeling, security testing, and vulnerability management and remediation; software security frameworks and maturity models; industry recognized certification in security ; and, exposure to one or more of the following technologies: cloud computing, application containers such as Docker or OpenShift, Infrastructure-as-Code, microservices, identity and access management.