ECIOSS PWS.pdf

OFFICE OF THE CHIEF INFORMATION OFFICER (OCIO)

OFFICE OF PERSONNEL MANAGEMENT (OPM)

ENTERPRISE CYBER, INFRASTRUCTURE & OPERATIONS SUPPORT SERVICES (ECIOSS)

PERFORMANCE WORK STATEMENT

Table of Contents Part 1 General Information

1. General

1.1 Background

1.1.1 Organizational Roles

1.2 Purpose

1.3 Objectives

1.4 Scope

1.5.1 Hours of Operation

1.6 General Contract Performance Information

1.6.1 Place of Performance

1.6.2 Travel

1.6.3 Government Furnished Equipment (GFE)

1.6.4 Physical Security of Equipment and Data

1.6.5 Contracting Officer Representative (COR)

1.6.5.1 Technical Point of Contact (TPOC)

1.6.6 Key Personnel

1.6.6.1 Senior Program Manager

1.6.6.1.1 Senior Program Management Lead - Network

1.6.6.2 Cyber Integration Center Lead

1.6.6.3 Cyber Architecture and Engineering Lead

1.6.6.4 Continuous Monitoring and Authorization Services Lead

1.6.6.5 Network Engineering and Operation Lead

1.6.6.6 Network Operations Support Staff

1.6.6.7 Secure Access Service Edge Lead

1.6.6.9 Enterprise Firewall Lead

1.6.6.10 Cloud Solutions Architect

1.6.6.11 Senior Cloud Administrator

1.6.6.12 Senior MS365 Enterprise Administrator

1.6.6.13 Senior Exchange Engineer

1.6.6.14 Senior Systems Engineer

1.6.6.15 Mid System Administrator

1.6.6.16 System Administrator

1.6.6.17 Cloud Engineer

1.6.6.18 Senior SQL Administrator

1.6.6.19 Linux Engineer

1.6.6.20 Patching Lead

1.6.6.21 Operations Support Lead

1.6.6.22 Senior Desktop Engineer

1.6.6.23 MECM Administrator

1.6.6.24 PKI Administrator

1.6.7 Non-Key Personnel

1.6.8 Skills and Certifications

1.6.8 Organizational Conflict of Interest

1.6.9 Non-Disclosure Agreement

1.6.10 Standards, Policies, And Processes

Part 2 Performance Work Statement

2. Task Details

.2.1 Task Area 1: Program Management

2.1.1 Sub-Task: Transition Plan

2.1.2 Sub-Task: Risk Management Plan

2.2 Task Area 2: Managed Services

2.2.1 Managed Security Operations Center

2.3 Task Area 3: Enterprise Operations Center (EOC)

2.3.1 Sub-Task Senior Cybersecurity Incident Response Specialists

2.3.2 Sub-Task Information Technology Monitoring, Analysis, and Response

2.4 Task Area 4: Enterprise Cybersecurity Services Support

2.4.1 Sub-Task: Cyber Threat intelligence

2.4.2 Sub-Task: Continuous Penetration Testing

2.4.3 Sub-Task: Cyber Threat Hunting and Forensics

2.4.4 Sub-Task: Cybersecurity Engineering, Architecture, and Automation

2.4.5 Sub-Task: Enterprise Patch Management

2.4.6 Sub-Task: Enterprise Firewall

2.4.7 Sub-Task: Continuous Monitoring and Authorization Services

2.4.8 Sub-Task: Attack Surface Reduction (ASR)

2.5 Task Area 5: Network Operations, Infrastructure, and Architecture Support

2.5.1 Sub-Task: Network Engineering and Operations

2.5.2 Sub-Task: Secure Access Service Edge

2.5.3 Sub-Task: Infrastructure Engineering and Operations Support

2.5.4 Sub-Task: Endpoint Management

2.5.5 Sub-Task: Certificate and Key Management

2.6 Task Area 6: Surge Support

Part 3 Deliverables

3. Deliverables

3.1.1 Work Products

Appendix A: Service Level Agreements

Appendix B: OPM Tool Set

Part 1 General Information

1. General

1.1 Background

The Office of Personnel Management (OPM), Office of the Chief Information Officer (OCIO), Information Technology Operating Systems (ITOS), and Cybersecurity Divisions are modernizing and leveraging cloud technologies to improve the delivery of OPM services while also enhancing its infrastructure capabilities.

The newly restructured Enterprise Cyber, Infrastructure and Operations Support Services (ECIOSS) contract embraces OCIO’s primary objective of delivering high quality, reliable, and secure IT services that significantly enhance the ability for OPM to execute it mission. OCIO supports critical day-to-day operations and maintenance of services used by our customers routinely. The organization is geographically dispersed across primary locations in Washington DC, Boyers, Pennsylvania, and Macon, Georgia.

The following areas represent the existing services supported by this PWS:

Enterprise IT Operating Systems Services

Enterprise Cybersecurity Services

Cloud Operations

• Office 365 Administration

• Exchange Online

• SharePoint Online

• Teams

• OneDrive

• Power Platform

• Azure Cloud Administration

• Azure Active Directory (AD)

• Azure Resource Deployment

• Active Directory Federated Services

(ADFS)

• Intune

Enterprise Infrastructure

• VMWare

• NetApp

• PKI

• DNS

• Dynamic Host Configuration Protocol

(DHCP)

• File Services

• Remote Desktop Services (RDS)

• SQL database services (Shared Services)

• Data Backup/Restores

Enterprise Logging

• Application, network, Cybersecurity logging aligned to OPM and federal requirements

• Dashboard development

Cyber Risk Management

• Cybersecurity Policy Guidance

• Score Cards

• Cybersecurity Document Management

• Training and Awareness

• Cybersecurity Control Assessments

Monitoring, Breach, & Incident Response

• 24/7 Enterprise Monitoring, Incident Management and Response

• Situational awareness and communication

• Centralized Incident handling and

Coordination

• Dedicated Incident Response Personnel

• Federal Cybersecurity Reporting

Vulnerability & Baseline Management

• Ad-hoc, on-demand, and scheduled vulnerability scanning

• Incident Response

Server Operations

• Server and Application software installation

• Server Patching

• User Management

• Voice Over Internet Protocol (VOIP)

System Administration

• Datacenter Management

• Emergency Incident Response

Management and Facilitation

Exchange Administration

• Data restores for Freedom of Information Act (FOIA), and Office of General Counsel (OGC) requests

• Creating mailboxes

• Troubleshooting mail flow and routine issues

• Maintaining Exchange connectors

Endpoint Management

• Deployment, administration, and enhancements to OPM enterprise Microsoft Endpoint Configuration Manager (MECM) environment including both System Center Configuration Manager (SCCM) and Intune.

• Creation and maintenance of the base workstation builds and related Operating System Deployment tasks, application packaging and deployment, and vulnerability remediation activities.

• Vulnerability remediation activities as driven by vendor release cycles, DHS critical reports, and regular system scan data from Cybersecurity. Remediation’s includes software updates and system configuration changes.

• Application packaging and deployment activities driven by program office needs.

• Resolves Help Desk tickets related to any of the areas of support.

• Mobile device management for all OPM mobile endpoints.

Network Operations

• Layer2/Layer3 Networking

• Systems scanned every 72 hours per Department of Homeland Security (DHS) Binding Operational Directive (BOD)

• Baseline configuration compliance scanning, analysis, and compliance implementation

• Dynamic Code scanning Threat Intelligence & Hunting

• Open and closed source information gathering

• Detailed system assessments using MITRE ATT&CK Framework

• Automated intelligence ingestion

Cybersecurity Engineering & Architecture

• Identity, Credentialing, and Access Management (ICAM) support

• Enterprise cybersecurity controls management (Email Protection, Data Loss Prevention, Endpoint Detection & Response, Security Incident & Event Management Platform (SIEM)/Cybersecurity Orchestration & Automated Response Platform (SOAR), Logging)

• Cybersecurity Automation

• Zero Trust enablement

• Secure Design guidance

• Firewall Management o Micro-segmentation o Palo Alto operations and maintenance o Azure Firewall Premium operations and maintenance

• Azure Network Security Groups (NSG) and Application Security Groups (ASG)

Penetration Testing

• Scheduled and ad-hoc testing by dedicated OPM Pen Testers

• Post-test remediation support

• Threat emulation (phishing exercises, etc.)

ISSO Services

• OCIO supplied ISSOs for OPM FISMA systems o Routing protocols (Border Gateway Protocol (BGP), Open Shortest Path First o (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP) o Quality of Service o Network address translation, traffic management o Virtual Link Trunking (VLT), Virtual Port

Channel (VPC), Spanning Tree

• Cloud networking o Network Security groups o Application Security groups o Policy generation and enforcement o Express route and Virtual WAN hub services

• Software-defined Networking (SDN)

Services o VMware NSX-T, NSX-V o Vmware Vrealize Network Insight o Windows Server Virtualization o Azure Virtualization

• WAN Services o Circuits o Field Site Network o Private Line Services o Encryption o Express Route

• VPN

o Site to Site VPN o Remote Access VPN o Dynamic Multipoint Virtual Private

Network (DMVPN) Group Encrypted Transport Virtual Private Network

(GETVPN)

o Remote Access VPN

• SASE

o Remote access o Zero Trust Network Access o Tool infrastructure

• Wireless o Implementation o User Support o Cisco ISE

• F5/Load Balancing o F5 LTM (physical and virtual) o Akamai load balancing and traffic management

• Dedicated advisor to System Owner and system team

• Hosts a monthly customer forum

• Shared ISSO resources to standardize activities

• Continuous Monitoring

• Network Tools o Live action o Plixer o Netflow o Prime Infrastructure o Cisco Identity Services Engine (ISE) o Note: many of these tools will be replaced by cloud-based services

1.1.1 Organizational Roles

ITOS is responsible for the implementation, operations, and support of all cybersecurity and network related hardware and services on OPM’s enterprise network. As part of OPM Zero Trust Architecture, ITOS provides the overall implementation, management, and support of OPM’s Secure Access Service Edge (SASE) product and service offering.

ITOS infrastructure engineers design, implement, and operate evolving common infrastructure services that support the agency both in the cloud and on-premise environments. The organization also manages certificates and secure endpoint devices and application management and deployment of approximately 4,000 Windows laptops and 1,000 mobile devices (IOS and Android).

The Cybersecurity Division provides oversight and implementation of OPM’s Cybersecurity program through Enterprise Cybersecurity Services (ECS). CSD plays a key role in protecting the confidentiality, availability, and integrity of OPM infrastructure, data, and systems by addressing Federal Information Security Management Act (FISMA) of 2002, Privacy Act of 1974, Clinger-Cohen Act of 1996, OMB directives, OPM policies and related rules and regulations.

1.2 Purpose

The purpose of this requirement is to establish the full range of technical support services that align multiple operations between the Cybersecurity and ITOS Divisions.

1.3 Objectives

OCIO’s overall goal for services is to provide support and improve capabilities of both the network and cybersecurity teams, while improving cost efficiency for: 24x7 monitoring and analysis, cyber threat intelligence, cyber threat hunting, digital forensics, incident response, network and server performance, patching, upgrades and minimizing unplanned downtime.

1.4 Scope

The agency is embracing a more strategic, forward-looking, enterprise-minded approach that breaks down silos between programs. The stakeholders include end-users, taxpayers and retirees who require a secure, optimized, efficient network. OPM has identified major organizational capacity and capability challenges that it must address to accomplish the goals in this plan and better serve its stakeholders.

OPM through consolidation has an opportunity to leverage advancements in technology that will support innovation and improvement in products, services, information, and oversight regarding cybersecurity and IT operations. OPM is unifying the network and cybersecurity functional requirements by leveraging people, processes, and technologies to reduce cybersecurity risks. This aids in identifying threats faster and more efficiently; in addition to improving cybersecurity across the organization while cutting time to resolution for IT service outages.

For OPM to support users, networks, and end points, OCIO requires a vendor for all IT services through-out the entirety of the Systems Development Lifecycle (SDLC) in a Scaled, Agile Framework (SAFe) project management environment. To build a cohesive support organization, OCIO is requires one vision to combine the support and engineering mind-set in-order to advance OPM’s futuristic objectives. Under this PWS, the vendor shall perform the support and engineering tasks of OPM’s legacy systems while migrating OPM services to a Cloud-based, Zero Trust modernization effort while maintaining minimal service downtime throughout OPM’s Enterprise. The effort to support OPM will require a vendor to adhere to all Federal and Agency Cybersecurity and Privacy policies, processes, and procedures.

OPM’s enterprise services serve customers located in Washington, DC, Boyers, PA, Macon, GA, and provide remote information systems support services to 65 plus locations in various geographic locations supporting 2500 Servers, 52 FISMA systems, 22 remote offices, in addition to 5500 staff with distributed work locations.

1.5 Period of Performance

The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

1.5.1 Hours of Operation

The core working hours will be Eastern Standard Time (EST) 6:00 a.m. – 6:00 p.m., however support for this requirement is required 24 hours per day and 7 days per week no later than a 2-hour on-site response time unless otherwise noted for the position. Any adjustments to these working hours will be coordinated with the Contracting Officer Representative (COR) and Technical Points of Contact

(TPOC).

1.6 General Contract Performance Information

1.6.1 Place of Performance

The place of performance will be a mix of remote and at a Government site. The contractor shall have minimal physical presence at OPM Headquarters (Theodore Roosevelt Building (TRB)) Washington, DC., Macon, GA and Boyer, PA locations. It is not required that all the resources be physically located at OPM Headquarters; however, there should be sufficient staffing at the locations previously identified to support the close integration with OPM staff, OCIO Cybersecurity Team, IT Operations team, and the IT Help Desk. It is expected that the contractor will support the 24 hours per day, 7 days per week, 365 days per year integrated monitoring center in the contractor’s facility, not at an OPM location. The services required in this contract require periodic and semi-regular on-site support (e.g., emergency outages, equipment maintenance, customer engagement, training, badging, troubleshooting) by key and non-key personnel. In-office days may be requested individually or contiguously based on the needs of OPM. For example, OPM may request that the Program Manager be in the office “next Tuesday.”

It is expected that these services will be provided during periods when the federal government is closed and during holidays. The contractor shall ensure employee availability and productivity to guarantee successful contract performance. The contractor staff shall be available via telework in the event of inclement weather, natural disaster, or other nonscheduled government closures. The contractor is responsible for the protection and safety of any Government Furnished Property/Equipment at all times, whether at OPM’s location or offsite.

• Telework is defined as a physical presence at an OPM facility at a minimum of one day per week.

• Remote work is defined as performing duties at a location, other than an OPM facility, such as a primary residence.

OPM may require contractor personnel to report to one of the physical locations. Contractor personnel within 50-mile radius of the locations shall have 24 hours to report. OPM reserves the right to change the place of performance to 100% on site. If this happens the contractor shall receive a 30-day notice.

• Theodore Roosevelt Building (TRB)

1900 E Street, NW Washington, DC 20415

• Macon

4685 Log Cabin Drive, Macon, GA 301214

• Boyers

1137 Branchton Rd, Boyers, PA 16018

1.6.2 Travel

Travel may be required to locations outside of Boyers, TRB and Macon facilities. All travel shall be approved in advance of the travel and shall comply with the Government’s Travel Regulations.

Reimbursement for travel shall be in accordance with the Federal Travel Regulations. Contractor will be given approximately two weeks’ notice of necessary travel for planned activities. Contractor may travel with less than two weeks’ notice, if agreeable and adequate time exists to prepare necessary travel orders. Contractor shall not be reimbursed for local travel within a 50-mile radius of assigned duty station.

The contractor shall seek Government approval in advance of incurring any expenses associated with travel. Government approval is provided by the COR. The contractor shall provide estimated costs, including any quotes, with approval request. The approval request shall be sent to the COR courtesy copying the Technical Point of Contact. Allowable and reasonable costs incurred by the contractor will be reimbursed within the “not-to-exceed” ceiling established in the pricing schedule. The contractor shall not invoice the Government for any associated fee or profit above the actual costs incurred for travel. Once proposed costs are approved by the Government, the contractor shall not exceed the established ceiling. The worksite shall be considered as the location of the contractor’s on-site personnel.

1.6.3 Government Furnished Equipment (GFE)

Government shall provide a Azure Virtual Desktop (AVD) solution and Personal Identity Verification (PIV) cards to access OPM’s network and security environments. The government shall provide access to all cybersecurity and network operations tools necessary for performance under this PWS.

AVD will be OPM’s primary computing solution; however, GFE’s may be provided at OPM’s discretion.

Any functions that require dedicated or specialized hardware will be addressed on a case-by-case basis.

Minimum AVD Hardware Requirements o Operating systems: Windows 10 1703 or later o CPU: 1 GHz or faster processor o RAM: 1024 MB o Hard drive: 100 MB or more o Video: DirectX 9 or later with WDDM 1.0 driver. Teams audio and video offloading on Cloud PC benefits from a dedicated Graphics Processing Unit (GPU) within your physical endpoint device.

o PIV: Internal or External Card Reader

1.6.4 Physical Security of Equipment and Data

The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.5 Contracting Officer Representative (COR)

The COR will reside in the OCIO Resource Management Office (RMO). The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract;

perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including government drawings, designs, specifications;

monitor contractor's performance and notifies both the Contracting Officer and contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.6.5.1 Technical Point of Contact (TPOC)

The Technical Points of Contact will reside in the ITOS and Cybersecurity Divisions. TPOCs assist the COR in the administrative duties of the contract. TPOCs provide routine daily technical guidance within the bounds of the PWS. A letter of designation issued to the TPOCs, a copy of which is sent to the Contractor, states the responsibilities and limitations of the TPOCs.

TPOCs are not authorized to change any of the terms and conditions of the resulting contract.

1.6.6 Key Personnel

Key personnel are those personnel considered essential to successful contractor performance. The names of these personnel and any alternates shall be designated in writing to the contracting officer.

The contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential. Resumes, proof of certification, and signed letters of intent for these key personnel shall be submitted with the contractor’s technical quotation and must meet the minimum qualifications and certifications for the position. They shall contain a complete resume for the proposed substitute or addition, the mandatory certifications, and any other information requested by OPM. Replacements for key personnel shall possess qualifications equal to or exceeding the qualifications of the personnel being replaced. OPM must approve Key Personnel for the contract.

The following personnel are considered key personnel by the government.

1.6.6.1 Senior Program Manager

Oversight Purview: Task 1

Years’ Experience: 10

The contractor shall have experience communicating effectively with government personnel, maintaining appropriate contractor management interface with OCIO leadership, the COR, and TPOCs. In addition, the ideal candidate has experience in maintaining adequate staffing levels, management oversight, service level agreements, and other performance requirements.

Demonstration of adequate foresight into program planning by identifying problems, providing sufficient information on alternative solutions and impacts minimizing said impacts to the program to the government’s satisfaction. Demonstration of improving processes through training, as well as ensuring deliverables are timely and accurate to minimize the need for government intervention to avoid degradation of mission during critical times, while ensuring notification of significant problems to the appropriate government personnel. Additional experience in managing and monitoring burn rates is required.

Skills: General Project Management, strong written communication, strong presentation skills, diplomacy skills, ability to follow policy and procedures, team skills, knowing one’s limits, coping with stress, problem solving, and time management.

Certifications: Project Management Professional (PMP), PMI – Agile Certified Practitioner (PMI- ACP), Scrum Master, Product Owner, SAFe, Information Technology Project Management (ITIL and PMBOK)

Location: Maximum telework acceptable, but candidate is required to be located within a 50-mile radius of Washington DC

1.6.6.1.1 Senior Program Management Lead - Network

Oversight Purview: Task: 1 and 5

Years’ Experience: 10

The contractor shall be a Project Management Professional with significant experience in agile workflow management and oversight, SAFe agile experience, Microsoft Project and Teams, Azure DevOps board management, change management oversight and process flow, task tracking and prioritization.

Skills: Must be a certified Project Management Professional with commensurate experience in a technical enterprise setting, experience tracking tasks across various platforms is required and should include Project, Azure DevOps board, Kanban boards, Remedy, and other platforms as required. Detail oriented and comfortable with running and managing projects from within teams.

Certifications: PMP

Location: Maximum telework acceptable but needs to be able to come on site to Boyers or Macon

1.6.6.1.2 Mid-Level Program Coordinator – Network Operations

Oversight Purview: Task: 1 and 5

Years’ Experience: 5

The contractor shall be a Project Management Professional with significant experience in agile workflow management and oversight, SAFe Agile experience, Microsoft Project and Teams, Azure DevOps board management, change management oversight and process flow, task tracking, and prioritization.

Skills: Must be a certified Project Management Professional with commensurate experience in a technical enterprise setting, experience tracking tasks across various platforms is required and should include Project, Azure DevOps board, Kanban boards, Remedy and other platforms as required. Detail oriented and comfortable with running and managing projects from within teams.

Certifications: PMP

Location: Maximum telework acceptable but needs to be able to come on site to Boyers or Macon

1.6.6.1.3 Program Manager - Cyber

Oversight Purview: Task 1, 2, 3, and 4

Years’ Experience: 10

The contractor shall be a Project Management Professional, Certified Scrum Master, or PMI-ACP certified professional with significant cybersecurity program management expertise. Experience in agile workflow management and oversight using collaboration technologies such as Microsoft Project, Teams, Azure DevOps board management. Experience supporting the full spectrum Cybersecurity Programs.

Skills: Must be a certified Agile project management professional with commensurate experience in a technical enterprise setting, experience tracking tasks across various platforms is required.

Certifications: Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP, PMP, Certified Scrum Master (CSM)), PMI-ACP, SAFe Agile

Location: Maximum telework acceptable, but candidate is required to be located within a 50-mile radius of Washington DC

1.6.6.2 Cyber Integration Center Lead

Oversight Purview: Task 2,3

Years’ Experience: 10

The contractor shall have experience operating combined monitoring environment of an enterprise NOC/SOC, responsible for cybersecurity, network, cloud, web, and application event monitoring and incident handling. Demonstrated ability leading highly specialized IT and cybersecurity specialists. Experience integrating and managing agile principles into cybersecurity, network, application monitoring, cyber threat intelligence, threat hunting, penetration testing and forensics. Must have a strong understanding of ensuring uptime requirements are met, ability to independently respond to and communicate errors and hardware exceptions.

Skills: Strong written communication, strong presentation skills, diplomacy skills, ability to follow policy and procedures, team skills, coping with stress, problem solving, time management, technical foundation skills: cybersecurity principles, cybersecurity vulnerabilities and weaknesses, incident handling and analysis skills, understanding intruder techniques, maintenance of incident records.

Certifications: GIAC Certified Incident Handler (GCIH), CISSP, CompTIA Advanced Security Practitioner + (CASP+), CompTIA Cybersecurity Analyst (CySA+), PMP, CSM, PMI-ACP

Location: Maximum telework acceptable, but candidates are required to be located within a 50-mile radius of Washington DC or Boyers, PA

1.6.6.3 Cyber Architecture and Engineering Lead

Oversight Purview: Task 4

Years’ Experience: 10-15

The contractor shall have experience leading and guiding engineering teams of varied skill sets, across a portfolio of cybersecurity tools. Adopting and implementing to new & emerging technologies and processes, while leveraging Agile/DevOps methodologies to ensure deliverables are on time and within budget.

Skills: Strong written communication, strong presentation skills, diplomacy skills, ability to follow policy and procedures, team skills, knowing one’s limits, coping with stress, problem solving, time management, technical foundation skills: cloud cybersecurity principles, cybersecurity vulnerabilities and weaknesses, cybersecurity engineering, cybersecurity tools and understanding cloud technologies.

Certifications: CISSP, Cloud Security Certifications, Vendor Certifications, PMP, CSM, PMI-ACP

Location: Maximum telework acceptable, but candidates are required to be located within a 50-mile radius of Washington DC or Boyers, PA

1.6.6.4 Continuous Monitoring and Authorization Services Lead Oversight Purview: Task 4

Years’ Experience: 10

The contractor shall have experience integrating agile and managing principles into cybersecurity, network, application monitoring. Have experience in analyzing, planning, and executing the work necessary to ensure the confidentiality, integrity, and availability IT systems for the federal government as required by FISMA (Federal Information Security Modernization Act).

Skills: Will have technical knowledge, understanding and skills in Cybersecurity concepts, cloud services, infrastructure, networking, and data management. Need to have skills to work with minimal supervision and as part of a larger team. Experience in agile project management, maintenance and development of information systems security programs, documentation, policies, procedures, and tools is imperative. Practical experience in conducting cybersecurity control monitoring, and testing including vulnerability and compliance scans, cybersecurity control assessment, and risk analysis is essential.

Certifications: CISSP, CompTIA Security + (Sec+), CAP, CISA, CISM, SSCP, Network + (N+), Certified Ethical Hacker (CEH), PMP, CSM, PMI-ACP

Location: Maximum telework acceptable, but candidate is required to be located within a 50-mile radius of Washington DC

1.6.6.5 Network Engineering and Operation Lead

Oversight Purview: Tasks 5

Years’ Experience: 10

The contractor shall have experience implementing, supporting, and growing enterprise class network solutions in a highly available environment. Proven expertise in providing high quality technical solutions to a wide range of challenges with a focus on redundant layer 3 services, secure WAN solutions and the ability to work in a variety of environments including VMWare enterprise networked systems and all major cloud service provider environments.

Skills: Project lead and management experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, deep knowledge of enterprise class network technologies including proven success managing all aspects of a large multi-site layer 3 network using BGP and EIGRP, experience with next generation Virtual Private Network technologies like GETVPN, DMVPN and others, significant experience working with VMWare NSX as well as operational support and design experience within Microsoft Azure or and equivalent cloud service provider’s network environments

Certifications: AZ-900: Microsoft Azure Fundamentals, AZ-700 Designing and Implementing Azure Networking, Cisco Certified Network Associate (CCNA), Cisco Certified Network Professional (CCNP)

Location: Maximum telework acceptable, but candidates are required to be able to travel to Boyers, Macon, or Washington, DC in the event of catastrophic outages

1.6.6.6 Network Operations Support Staff

Oversight Purview: Tasks 5

Years’ Experience: 3

The contractor shall have experience configuring and supporting enterprise class network hardware in a highly redundant environment with a focus on ensuring uptime requirements are met, ability to independently respond to and correct errors and hardware exceptions on a wide variety of network hardware, the ability to be on site in one of OPM’s datacenter locations within 2 hours of an identified event.

Skills: Experience working independently and with a team to provide network support to enterprise class hardware systems, experience working with various infrastructure tools for monitoring purposes, network-based configuration backups, incident reporting, ticket tracking, excellent written and verbal skills

Certifications: AZ-900: Microsoft Azure Fundamentals, Cisco Certified Network Associate

(CCNA)

Location: Requires 2 network support specialists at each datacenter location Boyers, PA and Macon GA.

1.6.6.7 Secure Access Service Edge Lead

Oversight Purview: Task 5

Years’ Experience: 7

The contractor shall have hands on experience engineering, implementing, and managing a modern SASE solution, significant experience with generalized network services including layer 3 routing using EIGRP and BGP, Virtual Private Network solutions including IPSec and SSL VPN, proven track record of working independently and with a team to implement and support enterprise class technical solutions.

Skills: Project lead and management experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of zero trust principles and their application to securing a networked environment, direct support experience with 1 or more modern SASE solution, solid understanding of Virtual Private Network technologies, experience working within Microsoft Azure and/or other comparable cloud service provider’s network environments

Certifications: AZ-900: Microsoft Azure Fundamentals, AZ-700 Designing and Implementing Azure Networking, Cisco Certified Network Associate (CCNA)Location: Telework or remote work acceptable

1.6.6.9 Enterprise Firewall Lead

Oversight Purview: Tasks 4

Years’ Experience: 7

The contractor shall have significant experience in engineering, implementing, and supporting a wide variety of enterprise class network solutions including expert level support qualifications for Palo Alto firewalls, Microsoft Azure Premium firewalls, and other equivalent systems.

Experience working with VMWare backed networks and hosts, service inserted firewall solutions, traffic steering algorithms in VMware based systems, micro-segmentation strategies and flow based firewalling solutions, experience implementing user and application based inspection algorithms, expert level support of physical and virtual Palo Alto based firewall solutions, advanced understand of layer 3 technologies including routing protocols including BGP, experience with various Virtual Private Network technologies

Skills: Project lead and management experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of zero trust principles, flow based firewalling techniques, expert level support for Palo Alto firewalls in an enterprise environment. Experience with Microsoft Azure including configuration and support of Azure premium firewall and configuration of other segregation solutions including network security group and application security groups.

Certifications: AZ-900: Microsoft Azure Fundamentals, AZ-700 Designing and Implementing Azure Networking, Cisco Certified Network Associate (CCNA), Palo Alto Accredited Certification Engineer (ACE)

Location: Maximum telework acceptable, but candidates are required to be located within a 50-mile radius of Boyers or Macon in the event of catastrophic outages

1.6.6.10 Cloud Solutions Architect

Years’ Experience: 5

The contractor shall have experience in engineering solutions in Azure environments. Candidate must have experience working with Azure Express Routes, Azure Virtual WAN, and Azure Private Endpoints. Candidate will be required to coordinate with other teams and customers to gather requirements and architect a solution to meet the customer requirements in a cost-effective manner.

Skills: Project lead and management experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of Microsoft Azure key services. Experience deploying enterprise class solution in Microsoft Azure

Certifications: AZ-305

Location: Remote

1.6.6.11 Senior Cloud Administrator

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall be an expert level experience building cloud solutions and deploying resources in an enterprise environment. Candidate must have experience working with Azure Express Routes, Azure Virtual WAN, and Azure Private Endpoints well as a solid understanding of the platform’s key services, workloads, governance, and security. Additionally, the person filling this position should be familiar with PowerShell, the Azure interface, the Azure CLI, and Azure Resource Manager templates.

Skills: Experience working in and deploying services in Microsoft Azure. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of Microsoft Azure key services.

Certifications: AZ-104

Location: Remote

1.6.6.12 Senior MS365 Enterprise Administrator

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall have experience migrating data from on premise solutions into MS365 services such as SharePoint online, Exchange Online, and Teams. Candidate must have expert level knowledge of deploying, configuring, and supporting MS Teams VOIP solutions., this includes but is not limited to configuring and deploying Auto-Attendants and Call Queues.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering MS365 in an enterprise environment.

Certifications: MS365 Enterprise Administrator Expert

Location: Remote

1.6.6.13 Senior Exchange Engineer

Oversight Purview: Tasks 5

Years’ Experience: 10

The contractor shall have experience deploying and supporting MS Exchange in an enterprise environment. Expert level knowledge of Exchange Online and Hybrid deployments and migrations. Experience configuring email protection polices, data retention policies, and send/receive mail flow connectors and rules. Expert level knowledge of Exchange Management Shell, Familiar with the National Archives "Capstone" approach to federal retention and removal requirements.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, expert level understanding of Microsoft Exchange Online. Experience administering MS365 in an enterprise environment. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, and team focused.

Certifications: MS-220

Location: Boyers, PA and Macon GA OPM locations

1.6.6.14 Senior Systems Engineer

Oversight Purview: Tasks 5

Years’ Experience: 10

The contractor shall be an expert level experience deploying, configuring, and supporting domain infrastructure in a Windows environment. Expert level knowledge and experience working with Active Directory, multi forest multi domain, and configuring FSMO roles. Experience working with federated identities with Azure AD, Azure AD Sync, and ADFS. Experience managing systems at scale with Group Policy and PowerShell.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering Windows Server in an enterprise environment. Experience working in and deploying services in Microsoft Azure and VMware environment. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of Microsoft Windows Server.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.15 Mid System Administrator

Oversight Purview: Tasks 5

Years’ Experience: 8

The contractor shall have significant experience installing and configuring hardware and software, monitoring system performance and troubleshooting issues. Expert level knowledge of core Infrastructure services and functions including virtualization (VMWare), DNS, DHCP, Active Directory, etc. Candidate must have experience with scripting and automation tools as well as knowledge of Azure cloud key services.

Skills: Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering Windows Server in an enterprise environment.

Experience working in and deploying services in Microsoft Azure and VMware environments.

Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of Microsoft Windows Server.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.16 System Administrator

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall have experience installing and configuring hardware and software, monitoring system performance and troubleshooting issues. Knowledge of core Infrastructure services and functions including virtualization (VMWare), DNS, DHCP, Active Directory, etc.

Candidate must have experience with scripting and automation tools as well as knowledge of Azure cloud key services.

Skills: Experience administering Windows Server in an enterprise environment. Experience working in and deploying services in Microsoft Azure and VMware environments. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, solid understanding of Microsoft Windows Server.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.17 Cloud Engineer

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall be an expert level experience deploying, configuring, and supporting complex multi-site VMWare virtual infrastructure. Candidate must have extensive knowledge of ESX and vSphere application suite as well as an experience working within VMWare NSX environments.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering VMware vSphere in an enterprise environment. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, expert level understanding of VMware vSphere and related products. Experience in migrating VMware environments to the Azure cloud is a plus.

Certifications: VMWare VCP-DCV23

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.18 Senior SQL Administrator

Oversight Purview: Tasks 5

Years’ Experience: 8

The contractor shall have expert level experience supporting MS SQL environments at an Enterprise scale designing, deploying, and supporting SQL solutions. Candidate must have experience deploying SQL solutions in Azure.

Skills: Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering MS SQL in an enterprise environment.

Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, expert level understanding of Microsoft SQL Server.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.19 Linux Engineer

Oversight Purview: Tasks 5

Years’ Experience: 8

The contractor shall have expert level experience managing Linux systems at an Enterprise.

Candidate must have experience deploying and supporting RedHat Satellite and Ansible.

Candidate must have experience with and working knowledge of building and running Ansible playbooks and creating code base solutions to configure systems.

Skills: Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering Red Hat Linux servers in an enterprise environment. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, strong understanding of RHEL.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.20 Patching Lead

Oversight Purview: Tasks 4

Years’ Experience: 5

The contractor shall have deep analytical thinking based on research results to assess software patches, registry updates and configuration changes to be applied to varied infrastructure.

Provides assessment including cybersecurity, system, and business impact. The ideal candidate will have a good understanding of the cybersecurity implications of when applying patches.

Experience supporting servers in a complex enterprise environment. Expertise in deploying patches to systems using WSUS, SCCM, and Azure Automation tools. Candidate should have experience supporting and troubleshooting Windows and Linux Servers.

Skills: Demonstrable history of leading successful patching deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Proficiency in scripting of packaged installation of patches, software, and configuration changes, including power shell automation to improve patch management processes. History of optimizing pre- and post- patching process to ensure proper implementation without any outages. Analyze and foresee the side effects of the patch and be able to quantify the risks business impact, and opportunities (for better cybersecurity) when the patch is applied. Ability to work with product vendors to come up with suitable patch recommendations without compromising systems. Demonstrated experience in researching, evaluating, developing, designing and implementing patch remediation designs and standards following industry best practices.

Certifications: AZ 900

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.21 Operations Support Lead

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall have experience leading an incidence response team and managing SLA requirements on trouble tickets.

Skills: Demonstrable history of successfully leading an incident response team in and enterprise environment. Skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. team focused, strong understanding of Office 365 and Windows Server.

Location: Boyers, PA, Macon, GA, and Washington DC OPM locations

1.6.6.22 Senior Desktop Engineer

Oversight Purview: Tasks 5

Years’ Experience: 5

The contractor shall have expert level experience working with MECM at an Enterprise level.

Candidate must have experience designing, deploying, and enhancing the MECM environment to support modern desktop management co-management with Intune. Candidate must have experience with Microsoft Bit Locker.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering MECM and Intune in an enterprise environment. Demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused, expert level understanding of modern desktop management.

Certifications: MD-101

Location: Remote

1.6.6.23 MECM Administrator

Years’ Experience: 2

The contractor shall have experience installing, managing, and upgrading Windows-based systems at an enterprise scale. Candidate must have experience working with SCCM and Intune to manage machine configuration, system updates, compliance checks, and application deployments.

Skills: Skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering MECM and Intune in an enterprise environment.

Location: Remote

1.6.6.24 PKI Administrator

Oversight Purview: Tasks 5

Years’ Experience: 8

The contractor shall have expert level experience designing, deploying, and supporting PKI environments in a Windows domain. Candidate must have experience deploying internal certificate authorities. Must have experience issuing external certificates from external certificate authorities and installing certificates on systems. Building out and maintaining certificate authority databases. Expert level experience Designing, deploying, and supporting the use of smart cards for system authentication across the agency.

Skills: Project lead experience, demonstrable history of leading successful deployments of enterprise class solutions, skilled at producing technical documents and engineering diagrams, strong written and verbal skills, team focused. Experience administering Microsoft PKI solutions in an enterprise environment.