Attachment J-1 SOC SOW Job Descriptions (Rev 2).Rev 2

Attachment J-1 – Job Descriptions (Rev 2)

Security Operation Center

DTFACT-16-R-00004

ATTACHMENT J-1 – JOB DESCRIPTIONS

(Job Category 1) Int II System Security/Information Assurance Analyst (Incident Handler)

Applies to Section C.3.1.1.1 – Incident Handler Job Description:

The Incident Handler supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Incident Handler responsibilities include:

• Receive, document, and report cyber security events.

• Categorize incidents and implement corresponding escalation procedures.

• Communicate and coordinate incident response efforts.

• Conduct daily operational update meetings for SOC staff and unscheduled situational update briefings for FAA leaders.

• Analyze reports to understand threat campaign(s) techniques, lateral movements and extract indicators of compromise (IOCs).

• Provide telephone, e-mail and ticket service to customers.

• Reference applicable departmental and operating administration policies in work products

• Access, secure and inspect local classified information processing areas.

• Any other duties as requested by the Contracting Officer Representative and SOC management.

Qualities/Additional info: Incident Handler will maintain twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, incident handling capability. Incident Handler must be a proven team player with excellent oral and written communications skills. Incident Handler must be capable of working on projects independently. Frequent interaction with government client is required.

Candidate must have previous experience working in a network security incident response team, such as a Security Operations Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC). Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

- OR

- Minimum six (6) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience;

- Minimum four (4) years IT experience

AND

- Must have with at least one year of network security experience.

Preferred Experience:

- Experience with intrusion detection systems and threat techniques. (Lateral Movement, Rootkits

& Toolkits.

- Experience working in a network security environment, such as a Security Operations Center

(SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center

(CSIRC).

- Experience with business process reengineering, capability maturity model, change management, or process improvement.

- Exceptional writing and documentation skills.

Level of Clearance Required: Department of Defense Secret

US Citizenship Required: Yes No

(Job Category 2)

Senior II System Security/Information Assurance Analyst (Focused Operations)

Applies to Section C.3.1.1.2 – Focused Operations Job Description:

The Focused Operations analyst is an expert in hacker/hacktivist group capabilities and intentions, and nation-state sponsored CNE (computer network exploitation) and CNA (computer network attack) targeting the US Critical Infrastructure. This position supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users.

The work site is located in Leesburg, Virginia.

This position requires the ability to identify potential threats based on agency utilized hardware and software. The Focused Operations analyst shall be knowledgeable of current and evolving hacking tools and methodologies available to disrupt these systems.

The Focused Operations analyst responsibilities include:

• Contribute to daily operational update meetings for SOC staff and unscheduled situational update briefings for FAA leaders as necessary.

• Analyze reports to understand threat campaign(s) techniques, lateral movements and extract indicators of compromise (IOCs).

• Reference applicable departmental and operating administration policies in work products.

• Recommend sound remediation and recovery strategies, suggest defensive policy enhancements and information technology procedures.

• Access, secure and inspect classified information processing areas.

• Assist DOT and FAA law enforcement and counter intelligence offices with cyber investigations

• Provide forensic and network analysis.

• Threat detection and trend analysis.

• Understand and convey of the lifecycle of the network threats, attack vectors, and network vulnerability exploitation

• Maintain awareness of directives, orders, alerts, and messages.

• Provide content for FAA, and DOT shared situational awareness mechanisms i.e., websites, blogs, and Wikipedia style mechanisms.

• Maintain relationships with Intelligence Agencies, Law Enforcement (LE), and US Government organizations.

• Maintain situational awareness of cyber activity in the Information Technology (IT) by reviewing open source reporting for new vulnerabilities, malware, or other threats that have the potential to impact the organization.

• Develop indicators of compromise and context for content creation.

• Search for anomalous activity and investigate to provide identification; produce reports and briefs to provide an accurate depiction of the current threat landscape and associated risk

• Use customer, community, and open source reporting.

Qualities/Additional info: Under low/guarded risk level, required shifts for Focused Operations are (0800-1700, EST\EDT), Monday-Friday. Under the elevated or high risk levels, the required shifts are (0600-1400 EST\EDT) and (1000-1800 EST\EDT), Monday-Friday. Under the severe risk level, the Contractor must have the capability to augment staffing levels to support additional required shifts of (0800-1700, EST\EDT), Saturday and Sunday. Under all risk levels, the backfill of absent Focused Operations analysts are required for all periods of scheduled and unscheduled leave. Focused

Operations analysts should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. Focused Operations analysts should also be self-starters, capable of working on projects independently, if required. Extremely effective oral and written communications skills are a must, in order to present strategy, scripting output and status information to the client in both formal and informal review settings. Frequent interaction with government client is required.

Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum ten (10) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience.

AND

- Minimum four (4) years experience with cyber intelligence analysis experience.

Preferred Experience:

- Experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. security information management tools (e.g., NetForensics, ArcSight).

- Technical expertise in the capabilities and techniques of hacker/hacktivist groups, criminal syndicates, and advanced persistent threats conducting computer network exploitation and attacks against the U.S. government resources and critical infrastructure.

- Familiar with signatures, tactics, techniques and procedures associated with preparation for and execution/implementation of such attacks.

- Experience with intelligence briefings.

- Experience with threat analysis.

- Experience with intelligence products.

- Experience with early indications and warnings.

- Experience with Open Source intelligence techniques.

- Experience working in a network security incident response team, such as a Security Operations

Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

Level of Clearance Required: Department of Defense Top Secret/Sensitive Compartmental Information (TS/SCI)

(Job Category 3)

Senior I System Security/Information Assurance Analyst (Senior Monitoring Analyst) Applies to Section C.3.1.1.3 –Monitoring Analyst Job Description:

The Senior Monitoring Analyst supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Senior Monitoring Analyst responsibilities include:

• Support monitoring of all Information Assurance Devices (IADs) to identify and document all intrusions and attempted intrusions.

• Populate and maintain an intrusions database, and provide data analysis support; analyze data from sensors, network security devices and applications using the security information event management systems, log servers, application interfaces and device consoles provided.

• Document of evidence of system security compromise, generate of trend reports, and collect evidence of malicious or anomalous activity.

• Report security incidents and/or network intrusions to Incident Handlers for dissemination to appropriate DOT points of contacts.

• Identify anomalous and malicious activity.

• Contribute to content creation, prioritize, rank and escalated incidents.

• Provide support in the detection, response, mitigation, and reporting of cyber threats affecting client networks.

• Maintain an understanding of the current vulnerabilities, response, and mitigation strategies used in cyber security operations.

• Assist in producing status reports and briefs to senior leadership; provide analysis for correlated information sources.

• Provide liaison to other agency cyber threat analysis entities such as intra-agency and inter-agency Cyber Threat Working Groups.

• Maintaining proficiency in the use and production of visualization charts, link analysis diagrams, and database queries.

• Analyze and report cyber threats as well as assist in deterring, identifying, monitoring, investigating and analyzing computer network intrusions.

• Senior Monitoring Analysts must provide recommendations based on best practice and experience to develop processes that will enhance efficiencies needed to perform the above.

Qualities/Additional info: Senior Monitoring Analysts provide coverage twelve (12) hours a day, five

(5) days a week, including Federal government holidays. Under all risk levels, required shifts are (0600- 1400) and (1000-1800 EST\EDT), Monday-Friday, including Federal government holidays. Under all risk levels, the backfill of absent Senior Monitoring Analysts are required for all periods of scheduled and unscheduled leave. At the direction of the COR, the Contractor may be required to move personnel shifts in order to support demanding workloads, especially during core business hours. Senior Monitoring Analysts should be proven team players with excellent oral and written communications skills. Senior Monitoring Analysts should also be a self-starter, capable of working projects cradle-to-grave, independently if necessary. Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree

- Minimum ten (10) years of relevant professional experience.

- Minimum six (6) years IT experience

AND

- Must have four (4) years experience network security analysis, using intrusion detection systems.

- Must have experience conducting analysis at the packet level.

- Firewall administration experience.

- Experience with intrusion detection sensors.

- Experience with Security Information and Event Management Tools (ArcSight).

- CISSP and/or SANS/GIAC Certification (equivalent to two year experience).

(Job Category 4)

Assoc System Security/Information Assurance Analyst (Associate Monitoring Analyst) Applies to Section C.3.1.1.3 –Monitoring Analyst Job Description:

The Associate Monitoring Analyst supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Associate Monitoring Analyst responsibilities include:

• Support monitoring of all Information Assurance Devices (IADs) to identify and document all intrusions and attempted intrusions.

• Populate and maintain an intrusions database, and provide data analysis support; analyze data from sensors, network security devices and applications using the security information event management systems, log servers, application interfaces and device consoles provided.

• Document of evidence of system security compromise, generate of trend reports, and collect evidence of malicious or anomalous activity.

• Report security incidents and/or network intrusions to Incident Handlers for dissemination to appropriate DOT points of contacts.

• Identify anomalous and malicious activity.

• Contribute to content creation, prioritize, rank and escalated incidents.

• Provide support in the detection, response, mitigation, and reporting of cyber threats affecting client networks.

• Maintain an understanding of the current vulnerabilities, response, and mitigation strategies used in cyber security operations.

• Assist in producing status reports and briefs to senior leadership; provide analysis for correlated information sources.

• Provide liaison to other agency cyber threat analysis entities such as intra-agency and inter-agency Cyber Threat Working Groups.

• Maintaining proficiency in the use and production of visualization charts, link analysis diagrams, and database queries.

• Analyze and report cyber threats as well as assist in deterring, identifying, monitoring, investigating and analyzing computer network intrusions.

• Associate Monitoring Analysts must provide recommendations based on best practice and experience to develop processes that will enhance efficiencies needed to perform the above.

Qualities/Additional info: Associate Monitoring Analysts provide coverage twelve (12) hours a day, five (5) days a week, including Federal government holidays. Under all risk levels, required shifts are (0600-1400) and (1000-1800 EST\EDT), Monday-Friday, including Federal government holidays.

Under all risk levels, the backfill of absent Associate Monitoring Analysts are required for all periods of scheduled and unscheduled leave. At the direction of the COR, the Contractor may be required to move personnel shifts in order to support demanding workloads, especially during core business hours.

Associate Monitoring Analysts should be proven team players with excellent oral and written communications skills. Associate Monitoring Analysts should also be a self-starter, capable of working projects cradle-to-grave, independently if necessary. Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Education:

- Bachelor's degree

- Minimum six (6) years IT experience

AND

- Must have three (3) years experience network security analysis, using intrusion detection systems.

- Firewall administration experience

- Experience with intrusion detection sensors.

- Experience with Security Information Management Tools (ArcSight).

- CISSP and/or SANS/GIAC Certification (equivalent to two year experience).

(Job Category 5)

Senior Cert System Security/Information Assurance Analyst (SIEM Content Lead) Applies to Section C.3.1.1.4 Security Information and Event Management Content Lead Job Description:

The Security Information and Event Management Content Lead (SIEM) Content Lead supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The SIEM Content Lead is a member of the SOC Operations and Support Branch. The primary focus of the Branch is to research new COTS security tools, develop implementation plans and execute installations and upgrades, and maintain specific applications and their hardware in support of operational needs.

The SIEM Content Lead is required to support the following:

• Develop content for enterprise SIEM application, combining big data security information collection, management, and analytics capabilities with full network and log-based visibility and automated threat intelligence from commercial vendor and other government agencies.

• Develop and upgrade dashboards, channels, filters, rules, and reports, as needed.

• Integrate threat intelligence.

• Maintain and upgrade application to current (supported) version.

• Patch and update application software as needed.

• Maintain version control and document all changes.

• Develop processes for application use by all ArcSight users.

• Must be able to troubleshoot and install all components on Red Hat Linux platform.

Qualities/Additional info: SIEM Content Lead must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday-Friday between the hours of (0500 - 0000, EST\EDT). Backfill of absent Security Information and Event Management Content Lead is required for all periods of scheduled and unscheduled leave. SIEM Content Lead should be Certified ArcSight Security Analyst and a proven team player with excellent oral and written communications skills, and a fine attention to detail. He/she should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills are a must, in order to present strategy, architecture and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel.

Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum ten (10) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience;

- Minimum six (6) years IT experience.

- Must have at least four (4) years experience in the role of ArcSight Content development.

- Must be familiar with both Windows OS and Red Hat Linux for troubleshooting and installation.

Preferred Experience:

- Experience with business process reengineering, capability maturity model, change management, or process improvement; and experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. Security Information and Event Management systems).

- Previous experience as a cyber threat analyst and/or intrusion detection analyst is desirable

(Job Category 6) Senior Cert System Security/Information Assurance Analyst (Security Analytics Content

Lead) Applies to Section C.3.1.1.5 Security Analytics Content Lead Job Description:

The Security Analytics Content Lead supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

Security Analytics Content Lead responsibilities include:

• Develop content for enterprise full-packet capture security application, combining big data security information collection, management, and analytics capabilities with full network and log-based visibility and automated threat intelligence from commercial vendor and other government agencies.

• Perform daily Intrusion Detection Sensor (IDS) monitoring to ensure that all sensors are active.

• Review the Security Information and Event Management (SIEM) tool interface, as the tool correlates and aggregates alert data from multiple IDS sensor types and additional security devices.

• Review alerts and packet-level data collected from sensors on a daily basis and report findings to the Incident Handler.

• Submit an End-of-shift Report summarizing activities for each shift.

•Any other duties as requested by the Contracting Officer Representative and SOC management.

Qualities/Additional info: The Security Analytics Content Lead must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday-Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within six (6) hour notice to respond to DOT and SOC Management requirements. Security Analytics Content Lead should be proven team players with excellent oral and written communications skills. Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel...

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum ten (10) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience;

- Minimum six (6) years IT experience.

AND

- Must have at least four (4) years experience in full packet capture analysis.

- Must be familiar with both Windows OS and Red Hat Linux for troubleshooting and installation.

Preferred Experience:

- Experience with RSA Security Analytics

- Experience administering UNIX-based systems.

- Experience with Python scripting.

- Experience with intrusion detection sensors.

(Job Category 7)

Assoc. Technical Writer Applies to Section C.3.1.3.6– Associate Technical Writer Support Job Description:

The Associate Technical Writer is filled by an individual skilled in the area of IT technical writing and reporting. This position supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Associate Technical Writer is a member of the SOC Operations Support Branch. The primary focus of the Branch is to support SOC management and assist with the daily activities of running a SOC.

The Associate Technical Writer is responsible for:

• Editing, writing, and/or rewrites technical articles, publications, presentations, and other materials to communicate clearly and effectively research findings, technical developments, and other news and information to a wide range of external audiences.

• Interprets and administers documentation/ communication policies and procedures.

• Advises writers and researchers in matters of style, syntax, and usage to improve the general quality and effectiveness of communications.

• Exercises quality control over documents intended for external distribution. May participate in copy clearance process.

• Regularly contributes to the development of new concepts, techniques, and standards.

Considered expert in field within the organization.

Qualities/Additional info: Associate Technical Writer should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. Associate Technical Writer should also be a self-starter, capable of working on projects independently, if required. Effective oral and written communications skills are necessary to present strategy, scripting output and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information Systems

- Minimum six (6) years IT experience.

AND

- Must have least three (3) years experience in the role of Technical Writer.

- Must be familiar with: Microsoft Office & Project.

- Experience with business process reengineering, capability maturity model, change management, or process improvement.

(Job Category 8)

Int II System Security/Information Assurance Analyst (Cyber Security Services Branch Engineer)

Applies to Section C.3.1.2.1 – Cyber Security Services Job Description:

The Cyber Security Services Branch Engineer supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Cyber Security Services Engineer responsibilities include:

• Perform daily vulnerability assessment, threat assessment, mitigation and reporting activities in order to safeguard Agency information assets.

• Perform vulnerability scanning on Information Systems to ensure protection has been put in place on those systems.

• Conduct remote administration to include managing accounts, passwords, server updates, patching, and backups of Windows and Linux/Unix servers.

• Provide incident response functions when appropriate and coordinate activities with site Incidnet Handlers.

• Conduct research pertaining to the latest viruses, worms, etc. and the latest technological advances in combating unauthorized access to information.

• Write guidelines, standards, policies, procedures and other technical documentation.

• Support Information Assurance asset deployments, upgrades, and maintenance; including servers, databases, network assets and wireless intrusion detection (WIDS) LAN security

• Assess and review current technology infrastructure to identify key risks areas, and ensure adequate level of control are in place to address those risks.

• Recommend technological and architectural upgrades/modifications to Agency's Information

Systems Security architecture.

• Perform other Network Security/Information Assurance tasks as assigned.

• Support the Agency in publishing incidents, alerts, advisories and bulletins as required.

Qualities/Additional info: Cyber Security Services Engineer should be a proven team player with excellent oral and written communications skills. Cyber Security Services Branch Team Member should be a self-starter, capable of independently working projects. Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum six (6) years of relevant professional experience.

- Minimum five (5) years IT experience.

- Must have three (3) years experience administering Windows and UNIX-based systems and

TCP/IP networking.

Preferred Experience

• Experience with the following:

• HP WebInspect

• Red Seal

• DP Protect

• McAfee Vulnerability Manager

• Nessus

• HP Fortify on Demand (FOD)

• Wireless Intrusion Devices

• Authentication technologies (e.g. PGP, password files etc.)

• Knowledge of anti-virus software functionally and capabilities

• Knowledge of wireless LAN security (802.11)

• Advanced Routing and Switching, Remote Access, Multilayer Switching, Cisco IOS security, VPN security, and Troubleshooting

• LAN/System/Network administrator

• Windows, Linux, and networks

• TCP/IP (Network System Engineering)

• Maintain awareness on current "special threats

• Perform penetration tests

• CISSP and/or SANS/GIAC Certification, CCNP/CCDP a plus and Cisco WLAN certification a plus

• Experience working in a network security environment, such as a Security Operations

Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

(Job Category 9)

INFOSEC Systems Technical Engineer (Cyber Security Services Branch Team Lead) Applies to Section C.3.1.2.1 – Cyber Security Services Job Description:

The Cyber Security Services Branch Team Lead supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

Cyber Security Services Branch Team Lead responsibilities include:

• Oversee, and:

o Perform daily vulnerability assessment, threat assessment, mitigation and reporting activities in order to safeguard Agency information assets.

o Perform vulnerability scanning on Information Systems to ensure protection has been put in place on those systems.

o Conduct remote administration to include managing accounts, passwords, server updates, patching, and backups of Windows and Linux/Unix servers.

o Provide incident response functions when appropriate and coordinate activities with site

Incident Handlers.

o Conduct research pertaining to the latest viruses, worms, etc. and the latest technological advances in combating unauthorized access to information.

o Write guidelines, standards, policies, procedures and other technical documentation.

o Support Information Assurance asset deployments, upgrades, and maintenance; including servers, databases, network assets and wireless intrusion detection (WIDS) LAN security.

o Assess and review current technology infrastructure to identify key risks areas, and ensure adequate level of control are in place to address those risks.

o Recommend technological and architectural upgrades/modifications to Agency's

Information Systems Security architecture.

o Provide input to draft InfoSec policies and procedures.

o Perform other Network Security/Information Assurance tasks as assigned.

o Support the Agency in publishing incidents, alerts, advisories and bulletins as required.

• Any other duties as requested by the Contracting Officer Representative and SOC management.

Qualities/Additional info: Cyber Security Services Branch Team Lead should be a proven team player with excellent oral and written communications skills. Cyber Security Services Branch Team Lead should also be a self-starter, capable of working projects cradle-to-grave, independently if necessary.

Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum six (6) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience;

AND

- Minimum ten (10) years IT experience. Must have three (3) years experience with Vulnerability Assessment (VA) and penetration methods. Along with three (3) years experience administering Windows and UNIX-based systems and TCP/IP networking.

Preferred Experience :

• Experience with the following:

o HP WebInspect o Red Seal o DP Protect o McAfee Vulnerability Manager o HP Fortify on Demand (FOD) o Wireless Intrusion Devices o Authentication technologies (e.g. PGP, password files etc.)

o Knowledge of anti-virus software functionally and capabilities o Knowledge of wireless LAN security (802.11) o Advanced Routing and Switching, Remote Access, Multilayer Switching, Cisco IOS security, VPN security, and Troubleshooting o LAN/System/Network administrator o Windows, Linux, and networks o TCP/IP (Network System Engineering) o Maintain awareness on current "special threats o Perform penetration tests

• CISSP and/or SANS/GIAC Certification, CCNP/CCDP a plus and Cisco WLAN certification a plus.

• Experience working in a network security environment, such as a Security Operations Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

(Job Category 10)

Programmer (Incident Tracking Tool Programmer) Applies to Section C.3.1.2.2 – Incident Tracking Tool Programmer Job Description:

The Incident Tracking Tool Programmer is filled by an individual skilled in the area of scripting and programming. This position supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Incident Tracking Tool Programmer responsibilities include:

• Develop automation scripts to streamline processes on Linux OS.

• Front-end development using: Turbo (PL/SQL), JavaScript, AJAZ, CSS, and HTML.

• Recommend and develop automation scripts to enhance effectiveness of applications or processes.

• Develop data integration scripts with knowledge of JSON, XML and TEST API.

• Must be proficient with Windows and Linux OS.

Qualities/Additional info: Incident Tracking Tool Programmer should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. He/she should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills are necessary to present strategy, script output and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum six (6) years of relevant professional experience.

Experience:

- In addition to required education or equivalent experience;

- Minimum six (6) years IT experience.

AND

- Must have three (3) years of experience in the role of programmer/scripting specialist with

PERL and SQL scripting.

- Must be familiar with both Windows OS and Linux for troubleshooting and installation.

- Experience with business process reengineering, capability maturity model, change management, or process improvement.

- Experience with requirements and/or configuration management tool, such as PVCS, CVS or

SVN.

Experience in all of the following areas:

• RSA Resilient

• Windows & Linux environment familiarity

• Turbo Enterprise Framework familiarity

• Java Scripting

• Java

• XML, JSON

• Oracle

• HTML

• AJAX

• CSS

(Job Category 11)

Senior I System Security/Information Assurance Analyst (Senior Sensor Maint.)

Applies to Section C.3.1.3.2 –Sensor Maintenance Support Job Description:

The Senior Sensor Maintenance is filled by an individual skilled in the area of sensor configuration, design, maintenance, and signature development. This position supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

These systems are deemed critical to the SOC and require maintenance of all product and process documentation. The Senior Sensor Maintenance requires the ability to:

• Provide the technical expertise required to modify (upgrade) and/or replace existing SOC monitoring devices as needed.

• Install, maintain, monitors, troubleshoots, and decommissions sensor devices

• Configured in accordance with DOT and SOC standards.

• Maintain configuration control of all signatures and test them before being deployed in the operational environment.

• Evaluate and test all upgrades and patches prior to deployment in production.

• Identify requirements for additional sensor locations which will enhance the situational awareness capability.

• Underlying factors affecting the expansion of sensor deployment will be the results of the ongoing Network Mapping task and the continued installation of Intrusion Detection Sensors.

• Coordinate and assist local personnel in the installation of network intrusion detection systems as approved by the COR or SOC management.

• Support the DOT in the preparation of site coordination reports for each installation.

• These reports will contain at a minimum:

o Point-of-Contact (POC) information from the site (e.g., network technician and Information Systems Security Manager (ISSM), if applicable), o Installation location and applicable addresses, network diagrams to include Network Intrusion Device sensor configuration information (proposed and installed), connection details, and facility requirements.

• Develop IDS Life Cycle plan for all IDS, including support with testing of new IDS systems.

• Lead configuration management and develop processes to track system and signature change

• Lead deployment planning and implementation tasks.

Qualities/Additional info: Senior Sensor Maintenance must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday-Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within three (3) hour notice to respond to DOT and SOC Management requirements. Senior Sensor Maintenance should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. He/she should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills are necessary to present strategy and status information to the client in both formal and informal review settings. Frequent interaction with government client is required.

Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Education:

- Bachelor's degree in Computer Science or Information systems.

OR

- Minimum ten (10) years of relevant professional experience.

Experience:

• In addition to required education or equivalent experience;

• Minimum six (6) years IT experience.

• Experience with the following;

o Advanced Routing and Switching, Remote Access, Multilayer Switching, Cisco IOS security, VPN security, and Troubleshooting o LAN/System/Network administrator, o Windows and Linux networks, o TCP/IP (Network System Engineering), o Cisco IDS devices o Cisco and juniper Firewalls o Experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. security information management tools (e.g., NetForensics, ArcSight o Experience with business process reengineering, capability maturity model, change management, or process improvement.

• Experience working in a network security environment, such as a Security Operations Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

(Job Category 12)

Int. II System Security/Information Assurance Analyst (Intermediate Sensor Maint.)

Applies to Section C.3.1.3.2 –Sensor Maintenance Support Job Description:

The Intermediate Sensor Maintenance is filled by an individual skilled in the area of sensor configuration, design, maintenance, and signature development. This position supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Intermediate Sensor Maintenance requires the ability to:

• Install, maintain, monitor, troubleshoot, and decommissions sensor devices.

• Configured in accordance with DOT and SOC standards.

• Maintain configuration control of all signatures and test them before being deployed in the operational environment.

• Evaluate and test all upgrades and patches prior to deployment in production.

• Identify requirements for additional sensor locations which will enhance the situational awareness capability.

• Underlying factors affecting the expansion of sensor deployment will be the results of the ongoing Network Mapping task and the continued installation of Intrusion Detection Sensors.

• Coordinate and assist local personnel in the installation of network intrusion detection systems as approved by the COR or SOC management.

Qualities/Additional info: Intermediate Sensor Maintenance must utilize ordered hours to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday- Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within three (3) hour notice to respond to DOT and SOC Management requirements. Intermediate Sensor Maintenance should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. Intermediate Sensor Maintenance should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills are necessary to present strategy and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

• Bachelor's degree in Computer Science or Information systems.

OR

• Minimum six (6) years of relevant professional experience.

Experience:

• In addition to required education or equivalent experience;

• Minimum three (3) years IT experience.

Experience with the following:

• Experience with the following;

o Advanced Routing and Switching, Remote Access, Multilayer Switching, Cisco IOS security, VPN security, and Troubleshooting o LAN/System/Network administrator, o Windows and Linux networks, o TCP/IP (Network System Engineering), o Cisco IDS devices o Experience with Python scripting o Cisco and juniper Firewalls o Experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. security information management tools (e.g., NetForensics, ArcSight.)

o Experience with business process reengineering, capability maturity model, change management, or process improvement.

• Experience working in a network security environment, such as a Security Operations Center (SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

(Job Category 13)

Senior I Scientist/Engineer/Systems Analyst (Security Analytics System Engineer) Applies to Section C.3.1.3.4 – Security Analytics System Engineer Support Job Description:

The Security Analytics System Engineer supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The Security Analytics System Engineer requires the ability to:

• Plans, conducts and oversees highly complex projects or major phases of significant projects;

Performs security network engineering efforts.

• Conducts investigations and tests of complex security software systems to enhance performance or investigate and resolve matters of significance.

• Reviews completion and implementation of technical products to ensure success and timeliness.

• Reviews literature, and current practices relevant to the solution of more complex network security projects.

• Recommends corrections in complex technical applications and analysis to enhance performance.

• Acts as the initial contact with vendors on more complex projects to provide required products or services.

• Provides leadership and work guidance to less experienced personnel.

• Provides technical consultation to other organizations; interacts with senior customer personnel and internal senior management.

• Provides the customer base with first level support.

• Performs comprehensive security assessment of all designs within all enterprise networks, advises senior level executives of network vulnerabilities, and develops procedures and policies to rectify.

• Any other duties as requested by the Contracting Officer Representative and SOC

Qualities/Additional info: Security Analytics System Engineer should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. He/she should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills necessary to present strategy, architecture and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science, Information systems.

OR

- Engineering, network security analysis or OS programming.

- Minimum six (6) years of Computer Network Defense (CND) experience.

- Experience with Enterprise Sensors (Sourcefire, SNORT, Cisco, ISS, McAfee, etc.).

- Experience with IDS/IPS custom signature creation and deployment.

- Experience with full packet capture and DNS technology and concepts.

- Experience with network principals, routers, switches, firewalls and VPN technologies.

- Experience writing policies, procedures, and TTPs.

- Experience composing presentations and briefing senior management.

- CISSP, CCNA, Security+ and/or relevant Certification.

- Minimum eight (8) years of experience in network security.

- Development experience with a programming language, especially the following: C, C++, Java, with additional familiarity in languages such as Ruby, Perl, Python, and SQL.

- Experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. security information management tools like ArcSight).

- Experience with NAC and web proxy solutions (ForeScout, BlueCoat, etc.).

- Strong analytical and creative problem solving skills to resolve highly complex software design issues and create new software.

- Good leadership skills to mentor, oversee, and lead team members.

- Strong interpersonal skills to interact with senior customers, management and team members.

- Strong communication skills to interact with team members and senior support personnel.

- Experience working in a network security environment, such as a Security Operations Center

(SOC), Computer Emergency Response Team (CERT), Computer Incident Response Team (CIRT), Computer Incident Response Center (CIRC) or Cyber Security Incident Response Center (CSIRC).

(Job Category 14)

Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Applies to Section C.3.1.3.4 – Security Analytics System Engineer Support Job Description:

The FAS Engineer supports a Civilian Agency Cyber Security Operations Center (SOC) organization protecting the network security of tens of thousands of users. The work site is located in Leesburg, Virginia.

The FAS Engineer requires the ability to:

• Plans, conducts and oversees highly complex projects or major phases of significant projects;

Performs security network engineering efforts.

• Conducts investigations and tests of complex security software systems to enhance performance or investigate and resolve matters of significance.

• Reviews completion and implementation of technical products to ensure success and timeliness.

• Reviews literature, and current practices relevant to the solution of more complex network security projects.

• Recommends corrections in complex technical applications and analysis to enhance performance.

• Acts as the initial contact with vendors on more complex projects to provide required products or services.

• Provides leadership and work guidance to less experienced personnel.

• Provides technical consultation to other organizations; interacts with senior customer personnel and internal senior management.

• Provides the customer base with first level support.

• Performs comprehensive security assessment of all designs within all enterprise networks, advises senior level executives of network vulnerabilities, and develops procedures and policies to rectify.

Qualities/Additional info: FAS Engineer should be a proven team player with excellent oral and written communications skills, and a fine attention to detail. He/she should also be a self-starter, capable of working on projects independently, if required. Extremely effective oral and written communications skills are necessary to present strategy, architecture and status information to the client in both formal and informal review settings. Frequent interaction with government client is required. Occasional local travel. Occasional local travel. Infrequent (<5%) local travel, infrequent (<5%) long distance travel.

Job Qualifications:

Required Education and Experience:

Education:

- Bachelor's degree in Computer Science, Information systems.

OR

- Minimum ten (10) years of relevant professional experience.

- Engineering, network security analysis or OS programming.

- Minimum six (6) years of Computer Network Defense (CND) experience.

- Experience with Enterprise Sensors (Sourcefire, SNORT, Cisco, ISS, McAfee, etc.).

- Experience with IDS/IPS custom signature creation and deployment.

- Experience with full packet capture and DNS technology and concepts.

- Experience with network principals, routers, switches, firewalls and VPN technologies.

- Experience writing policies, procedures, and TTPs.

- Experience composing presentations and briefing senior management.

- Development experience with a programming language, especially the following: C, C++, Java, with additional familiarity in languages such as Ruby, Perl, Python, and SQL.

- Experience with information security devices (e. g., firewalls, and intrusion detection/prevention systems) and applications (e.g. security information management tools like ArcSight).

- Experience with NAC and web proxy solutions…