COMET IDIQ PWS Updated 11 June 2020 MASTER DOCUMENT.pdf

PERFORMANCE WORK STATEMENT

(PWS)

Name: Communications & Enterprise Information Technology Support

Services (COMET) IDIQ

Organization: National Air & Space Intelligence Center

Address: 4180 Watson Way, Wright-Patterson AFB, OH 45433

1 PURPOSE

The National Air and Space Intelligence Center (NASIC) is the Department of Defense’s (DoD) primary source for foreign air and space threats. NASIC produces integrated, predictive intelligence in the air, space, and cyberspace domains enabling military operations, force modernization and national policymaking. NASIC’s information technology (IT) support personnel are embedded across several squadrons that support and enable NASIC’s varied and unique missions.

The Communications and Information Directorate (SC) is responsible for delivering IT services to enable NASIC and partner missions. Services include physical facility access control and intrusion detection, network management and design, storage and backups, servers, operating system support, data center hosting, service/helpdesk, workstation/printer/peripheral life-cycle support, sustainment applications, accounts management, voice communication system support, software, cybersecurity, systems engineering, video conferencing, Defense Logistics Agency Disposition Services (DLADS), equipment accountability, records management, compliance support, configuration management, audiovisual support, infrastructure cabling, mobile computing, telephone installation, conference facility support, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and cloud offerings.

The Geospatial and Signatures Intelligence Group (GS) conducts distributed intelligence, surveillance, and reconnaissance (ISR) operations and creates advanced capabilities to enable technical intelligence and battlespace characterization. The Measurement and Signature Intelligence (MASINT) Analysis Squadron provides timely and relevant processing, exploitation, dissemination and integration of radar and electro-optical data to characterize weapons systems in support of US military operations, national policy making, US weapon system acquisition, and intelligence community assessments. The Persistent Infrared Analysis Squadron provides innovative processing, exploitation, and dissemination of intelligence products derived from service and national Persistent Infrared sensors integrating intelligence analysis and leading edge research, development, and acquisition management to advance service and national-level capabilities enabling all-source analysis, full-spectrum military operations, force modernization, and policy making.

The Air & Cyberspace Intelligence Group (AC) is responsible for creating all-source intelligence defining the present and future air, air defense, and cyber threats to enable military operations, force modernization, and policy making. The Engineering Analysis Squadron requires contractor assistance to provide IT Support Services for the administration of networks enabling threat modeling, simulation, and analysis.

The Space, Missiles and Forces Intelligence Group (SM) delivers integrated, predictive intelligence on space, ballistic missile, regional and future threat capabilities to enable U.S. decision-making advantage in the air, space, and cyber domains.

The Global Exploitation Intelligence Group (GX) collects, exploits, and analyzes air, space, and cyberspace information to create integrated intelligence for NASIC and the Nation. The Signals Analysis Squadron (GXS) utilizes engineering principles to create technical signals intelligence and digital network intelligence to determine the design characteristics and actual performance of foreign air, space and cyberspace threat systems in order to support NASIC scientific & technical (S&TI) requirements and the intelligence community (IC). The Information Exploitation Squadron (GXK) provides the foundation for Open Source and all-source analysis through the management of Publicly Available Information (PAI)/Open Source (OS) collection requirements, intelligence research tasks, PAI/OS acquisition and exploitation, development of OS collection, processing, exploitation and dissemination capabilities, language processing technologies, storage, and dissemination of OS data and products, and production and dissemination of OS/PAI products and information services.

The Security Office (SO) serves as the Special Security Office/Officer, advises the Commander/Senior Intelligence Officer (SIO), and provides overall security support to NASIC’s mission including the development, implementation, and enforcement of security policy. Regarding this effort, the execution of the Center’s physical security and integrated defense program spanning multiple security facilities is critical to obtain and maintain physical security accreditation and protect national security assets.

NASIC is located at Wright-Patterson Air Force Base (WPAFB), Fairborn, OH, Springfield Air National Guard (ANG) Base, Springfield, OH, with an operating location at Bolling Air Force Base, Washington, DC.

2 SCOPE

Provide support for NASIC’s 4,500 users; 13,336 computer accounts; 37 networks; over 11,653 desktops of varying brands; over 2,111 virtual and physical servers of various operating systems and brands; 30 PB of disk storage; over 383 petabytes of tape storage;

administration and evolution of multiple databases and middle tier platforms across multiple networks and environments; 917 distinct software titles; printers, scanners, copiers, fax machines and multi-function devices of various brands; 18 different operating systems; over 1500 miles of network fiber; seven primary VTC facilities;

upwards of 70 desktop VTC devices; a facility access control system and intrusion detection system; and the largest SCIF conference center in the Intelligence Community.

NASIC is implementing a DevSecOps environment coupled with Agile methodologies to achieve results through automation, continuous capability enhancements, and robust feedback loops. The Government intends to provide a shared, collaborative environment among the development, testing, quality assurance, cybersecurity, and operations teams.

Support for this environment includes implementation, enhancement, and maintenance services required to successfully implement and sustain applications. The application lifecycle environment enables the Government to automate the building, testing, and deployment of applications.

All contracted support personnel shall have a Top Secret Sensitive Compartmented Information (TS SCI) security clearance with an up to date (having been completed within the six years immediately preceding the date of contract award) Single Source Background Investigation (SSBI). Certain contractor personnel shall also satisfy additional security requirements as detailed in section 7.

All contractor personnel shall comply with NASIC policies, processes, procedures, national and local security rules, regulations, and requirements.

Primary hours of support (core work hours) for NASIC facilities at WPAFB shall be 0600 – 1800, Monday through Friday, Eastern Standard Time (EST). Other types of support may be necessary outside the core work hours to ensure that NASIC operations are not negatively impacted. Some areas of support shall require 24/7 staffing.

3 REQUIREMENT(S)/DESCRIPTION OF SERVICE(S)

Ordering period shall be 5 years following the contract award date. Task level performance work statements will define actual efforts and deliverables.

Communications Focal Point/Service Desk Support/Touch Maintenance/ Accounts

Management

• Provide Service Desk support 24 hours a day for 365 days per year and be the single point of contact for IT related issues for both internal and external customers resulting in over 200 incidents daily and over 30,000 annual incident or service requests using Service Manager and Remedy as the enterprise response tools

• Possess knowledge and understanding of the following operating systems for Servers and Desktop: Solaris UNIX, Red Hat Enterprise and CentOS LINUX, and Microsoft Windows

• Answer Level 1 inbound calls, web-cases, and web chats, assess customer’s technical support needs and handle/route accordingly using documented procedures and available tools within 1 business day. Customer calls/web cases/web chats must be escalated to the next tier and logged within 1 business day

• Provide Service Desk First Response resolution for all Incident Request within 1 Business day or escalated to the next tier within 1 business day

• Provide Service Desk Support for media accountability and virus scanning to include coordinating with customers, other contractors to verify and validate data and assuming control of all media resulting on about 200 service calls monthly

• Provide Level 1 and 2 technical support for PaaS, IaaS, Cloud, specialty engineering, application/database administration technical issues

• Provide Level 2 remote and at-the-desk diagnosis/resolution of end-user requests/problems in a customer service oriented, team environment within 2 business days or assign the ticket to the next tier within 3 business days

• Perform duties of CFP Lead (i.e. Crew Commander) outside of core work hours including monitoring (network, system, environmental) of multiple data centers/facilities utilizing a variety of scripts, web-pages, and commercial applications, performing notification recalls to NASIC subject matter experts (SMEs), leadership and/or external agencies based on alarm/event types, coordinating response actions, and documenting artifacts for after action analysis

• Provide Service Desk support for Accounts Management to create, modify, delete, diagnose, and resolve account requests/problems

• Provide Service Desk support to provision, modify, de-provision, diagnose and resolve mail requests/problems for mail accounts across all domains

• Provide a Service Desk Trusted Agent to support, distribute, and track PKI/SIPRNet Tokens and create, modify, delete, diagnose, and resolve account requests/problems

• Work directly with outside agencies, AF Entities, and other organizations to resolve non-internal issues for NASIC customers

• Provide telework support via approved collaboration tools, chats, and telephone calls, assess customer’s technical support needs, and handle/route accordingly using documented procedures and available tools within 1 business day

• Provide monthly functional area reports summarizing work accomplished, work planned in next month and important issues occurring during the month

DLADS Support

• Provide support to over 450 annual tickets to receive, sanitize, and prepare IT equipment for pickup or reuse per DLA Disposition Service Computer Disposal Regulations DoDM 4160.21 Vol 4 Page 105. Equipment includes, but not limited to, desktops, laptops, mobile phones, servers, peripherals, printers, scanners, and multi-function devices. Manage Service Manager queue for all turn in request with a resolution to the request within 7 business days

• Prepare all Classified and Unclassified hard drives for destruction or disposition by external agencies per IC and DoD Instructions

• Recycle, reuse, or place back into service useable systems under warranty

• Perform as alternate NASIC Property Custodian (NPC) (or primary NPC) to handle the transfer of equipment if the Government NPC is not available

• Coordinate/schedule logistics for equipment with defense courier services, NASIC LGM and DLA for all incoming and outgoing equipment

• Estimated work load o Processed 36,461 assets in 2019

16,656 Peripherals (CAC readers, CD/DVD drives, keyboards, mice, KVM, monitors, speakers)

164 Phones (cell and VoIP) 2,086 Computers (desktops, laptops, tablets) 14,576 Internal Computer Components (circuit boards, memory, network, and video cards) 58 Printers/Plotters/Scanners 220 Servers and Components (servers, blades, cabinets) 59 Network Hardware (switches and components) 18 Televisions 4 Miscellaneous (UPS) 2,620 Hard Drives planned in next month, and important issues occurring during the month

Factory Support (Desktop, Printers and Peripherals)

• Build, deploy, and maintain 1,200 new IT systems and peripherals annually as required, or repurpose IT systems and peripherals

• Manage the Incident and Service Manager queues with resolution within 7 business days

• Fulfill Service Requests to install/maintain/repair/remove workstations and peripherals including software installation on workstations

• Maintain supply of break fix hardware and cables for printers, workstations, and peripherals

• Perform as the alternate NASIC Property Custodian (NPC) for computer inventory and accountability support in the factory

• Diagnose and resolve printer/scanner/Multi-Function Device (MFD) requests/problems for over 7 tickets daily (averaging about 400 annually) for printer support across all areas and types of printers to include specialty printers.

This resolution includes coordination with contracted/vendor service for warrantee work, ongoing maintenance tails, and required parts installation.

Printers vary across all manufactures from resin based 3D printers, MFDs, single use printers, and plotters to high end industrial printers.

• Provide dedicated Reorganization Move Planning Team (RMPT) desktop, printer, and peripheral support for NASIC Logistics (LG) o Estimated workload:

o ~2000 desktop moves requiring support per year o ~100 printer moves per year

• Continuously evaluate system build and software installation processes and adopt automation and self-service capabilities to improve service delivery

Software Administration/Installation/License Management

• Install, troubleshoot, and uninstall software across network systems in NASIC averaging about 2,900 Incident/Service requests annually

• Work with license managers, to include vendors, to finalize installation of all licensed software.

• Lead installation, troubleshooting and demolition actions required by internal and external agencies and work with vendors/original manufacturers for additional support needed

• Monitor, open, assign, update, and close tickets within 7 Business Days on up to 4 separate ticketing systems

• Troubleshoot assigned tickets using Standard Operating Procedures (SOPs) outlined at division level (SCO/SCX), to include weekly updates of trouble tickets every 7 business days

• Install desktop software to resolve trouble tickets

• Provide desktop support at the customer’s location as required, such as adding workstations to the domain, troubleshooting hardware issues, installing drivers;

desktop support includes Windows and Red Hat/CentOS Linux workstations and mobile computing (i.e. laptops and tablets)

• Coordinate with other duty sections such as hardware technicians and software administrators when additional Level II or Level III support is required.

• Physically or remotely log into the system and execute prepackaged Microsoft Installers (MSIs) or follow prescribed flowcharts/checklists

• Assist Air Force Network (AFNET) Enterprise Service Desk (ESD) with resolution of Remedy trouble tickets for software installation

• Prepare approved software for deployment through the Microsoft System Center Configuration Manager (SCCM) software application center. For Software (SW) titles not compatible with remote deployment technology, provide clear and precise installation instructions to the SW License manager

• Comply with Cybersecurity Certificate to Operate (CTO) processes

• Provide and update all documentation for all SW deployment packages

• Follow all Branch SOPs outlined at division levels (SCO/SCX) for SW deployment packages, to include patch management process outlined with Network Operations (SCOO)

• Update existing SW deployment packages when cybersecurity vulnerabilities are identified

• Work with the NASIC SW License Manager to track all licensed SW

• Maintain software file share on all networks

• Package software for the NASIC Application Catalog for SIPRNET and JWICS

• Utilize the NASIC trouble ticket tracking system (Microsoft System Center

Service Manager) and the Enterprise Service Desk (ESD) Trouble Ticketing system (e.g. Remedy) to track all customer requests

• Interface with external IT support agencies such as AFNET ESD, 88th CS, 16th AF, DISA, AMAC and AF JWICS ESD/ESC when appropriate

• Continuously evaluate software administration/installation/management processes and adopt automation and self-service capabilities to improve service delivery

• Build, present, and publish guardrails for approved software solutions and standards

Multinational Information Sharing (MNIS) Support

• Provide the following types of Level I IT support:

o Remote Support – provide remote diagnosis/resolution of end-user requests/problems in a customer service oriented, team environment o Touch Maintenance – provide at-the-desk diagnosis/resolution of end-user requests/problems in a customer service oriented, team environment Estimated work load:

• 25 NASIC corporate customers

• 5 Foreign Liaison Officers (LNO)

• Accounts creation and management for 25 plus personnel through the MNIS Program Management Office (PMO)

• Installation as required of new systems

• Management of 25 end user workstations

• Management of 3 network nodes

• New determination of requests per month for MNIS network

Work directly with the MNIS PMO support team for resolution If request/problem cannot be resolved remotely, transfer request/problem to MNIS PMO support team Primary hours of support (core work hours) for MNIS helpdesk support at WPAFB shall be 1200 – 2100, Monday through Friday, Eastern Standard Time (EST). Other types of support may be necessary outside the core work hours to ensure NASIC operations are not negatively impacted

• Follow all approved IC directives and standards in addition to NASIC policies, processes, and procedures

• Coordinate corrective action required by outside/parent agencies as required

• Provide administrative support as required such as granting/revoking network access and file permissions; performing file/directory restorations; installation of desktop software

• Provide administrative support to user account creation and maintenance to include resetting account passwords and unlocking accounts

• Provide desktop support at the customer’s location as required such as adding workstations to the domain, troubleshooting hardware issues, installing drivers

• Replace workstations with like systems and reload all applicable user applications

• Physically or remotely log into the MNIS system and execute prepackaged Microsoft

Installers (MSIs) or follow prescribed flowcharts/checklists

• Assist with account creation, modification, and deletion

• Create, modify, diagnose, and resolve account requests/ problems

• Interface with external MNIS PMO IT support agency

• Provide monthly functional area reports summarizing work accomplished, work planned in next month and important issues occurring during the month. Report shall include system and Plan of Action & Milestones (PoA&M) status (if applicable) and trend data

Network Services

• Provide network administration for NASIC networks including the 5 primary networks as well as all mission networks and data circuits

• Provide data center and cloud-based network administration for NASIC data-center networks including physical networking equipment and virtual networks to include software-defined networks

• Provide network security administration for NASIC firewalls, Virtual Private Networks (VPNs), Tactical Local Area Network Encryptors (TACLANEs), routers, and Access Control Lists (ACLs)

• Provide network cabling support throughout the NASIC enterprise to include the NASIC satellite locations on Wright-Patterson AFB, OH

• Provide Voice over IP (VoIP) instrument support to include the installation, maintenance, repair, removal, sanitization, and disposal

• Provide administration support for NASIC’s Cisco Unified Communications Manager and Unity voice mail service

• Provide system administration and security engineering operational support, maintenance, configuration, and documentation for NASIC cloud services including third party vendor services (ex: Amazon Web Services [Virtual Private Clouds and Elastic Compute Cloud], Microsoft Azure, Google Cloud, and VMware NSX)

• Install and maintain network switching, routing, and network security equipment throughout the NASIC enterprise to include the NASIC satellite locations on Wright-Patterson AFB, OH

• Provide Level II and III CFP escalation support

• Assist in the automation of monitoring and alerts from network services to CFP

• Continuously evaluate network administration processes and adopt automation and self-service capabilities to improve service delivery

• Coordinate with customers to track and complete aggressive preventative and predicative maintenance schedules.

• Build, present, and publish guardrails for approved network solutions and standards

Infrastructure Engineering and Installation

• Provide facility/premises network cabling design and network cabling bill of materials (quotes)

• Install, label, test, maintain, and remove premises network cabling throughout NASIC enterprise and NASIC satellite locations on Wright-Patterson AFB, OH

• Provide a semi-annual report of cabling parts received and consumed

• Maintain architectural diagrams and document all installations/changes in accordance with NASIC guidance

• Provide Level II and III CFP escalation support

• Provide dedicated Reorganization Move Planning Team (RMPT) infrastructure cabling support for NASIC Logistics (LG) o Estimated workload:

o ~2000 desktop moves requiring fiber work per year o ~100 help desk tickets per month

Datacenter Operations

• Physically install, move, and remove racks, servers, switches, tape libraries, power, network and Storage Area Network (SAN) cabling, and rack peripherals in the NASIC data centers

• Perform maintenance for non-emergency and emergency requirements including servers and tape libraries

• Assist with the troubleshooting process and repairs in case of event or equipment failure; provide recommendation to prevent reoccurrence of such events

• Assist with the maintenance of detailed site documentation of cross-connects and power circuits for provisioning

• Install and remove power whips and maintain circuit breaker panel schedule

• Track Data Center moves and infrastructure via Defense Property Accountability

System

• Maintain Data Center infrastructure information (location and identification of equipment, power connections, etc.) via Aperture Vista and track IT in Defense Property Accountability System (DPAS) for Automatic Data Processing Equipment (ADPE) tracking

• Assist Data Center manager as alternate NPC/Information Technology Equipment Custodian for Datacenter account

• Assist the Data Center manager with reviewing access logs and managing access to the data centers and racks

• Monitor Data Center operations to include the environmental systems (power/cooling/etc.), civil engineering systems, and security systems

• Assist in the automation of monitoring and alerts from Data Center operations to

CFP

• Assist the Data Center manager by ensuring data centers operate at maximum operational efficiency, including analyzing existing operating conditions, recommending new technologies and improving overall efficiency

• Monitor tracking and trending operational characteristics and proactively respond

• Coordinate with customers to track and complete aggressive preventative and predicative maintenance schedules

• Coordinate power and generator testing with LG and communicate to customers

• Continuously evaluate data center operations and adopt automation and self-service capabilities to improve service delivery

• Build, present, and publish guardrails for approved datacenter solutions and

Windows System Administration

• Maintain/administer/update Windows operating systems, products, applications, and services

• Maintain several automation and orchestration technologies

• Create and configure flexible solutions for DevSecOps, delivery, security, operations, oversight teams, ensuring system uptime, security, and performance

• Provide engineering support for complex implementations in an agile, product-centric environment

• Assess, deploy, and manage several infrastructure management tools (SCCM, Assured Compliance Assessment Solution [ACAS], Host-Based Security System [HBSS], Satellite server) including infrastructure optimization and orchestration solutions.

• Provide administrative support for agile and DevSecOps (DevOps) environments while articulating and implementing a balanced approach to security and redundancy.

• Provide production network integration between current and new services

• Maintain configuration management controls, to include security/update patches

• Develop change plans for Windows Enterprise/Domain modifications

• Maintain Active Directory and associated custom scripting for account validation, office symbol changes and administration of Group Policy Objects (GPO) with removal/disable of no longer required GPOs

• Automate tasks using approved automation tools to include Desired State Configuration (DSC), ansible, puppet, chef, or Terraform as applicable.

• Install, configure, maintain, and operate cloud-based servers (VMware, AWS, Azure, etc.)

• Assist in the automation of monitoring and alerts from Windows services to the

CFP

• Continuously evaluate Windows administration processes and adopt automation and self-service capabilities to improve service delivery

• Coordinate with customers to track and complete aggressive preventative and predicative maintenance schedules.

• Build, present, and publish guardrails for approved Windows solutions and

UNIX/Linux System Administration

• Maintain, administer, document, and update operating systems to include Solaris, Red Hat Enterprise Linux (RHEL), and CentOS products, applications and services; build, maintain, and administer RHEL license servers; develop change plans for operating system modifications; and provide information assurance, server, virtualization and storage support

• Assist with migration of legacy Solaris systems and services to current Linux and other applicable services

• Maintain, administer, and update third party Unix and Linux applications

• Provide and maintain workstation, server, JumpStart workstation, JumpStart server builds, VMware blueprints, and Cloud images

• Maintain and update network information system (NIS) maps, custom Samba file and print services, and programming and scripting languages and libraries

• Develop scripts to maintain integrity of critical network services (DNS, NIS, LDAP, VAS password synchronization) between Solaris, Linux, and Windows

• Perform functionality testing before application installation and regression testing post-install and generating before and after reports

• Develop scripts to maintain integrity of critical network services (DNS, NIS, LDAP and password synchronization) between Solaris, Linux and Windows

• Automate tasks using approved automation tools to include ansible, puppet, chef, or Terraform

• Assist with the management and utilization of the image repository for both on Premise and Cloud images.

• Install, configure, maintain, and operate cloud-based servers (VMware, AWS, Azure, etc.)

• Operate and maintain up to date patching/yum repository servers/services

• Assist in the automation of monitoring and alerts from UNIX/Linux services to the CFP

• Continuously evaluate UNIX/Linux administration processes and adopt automation and self-service capabilities to improve service delivery

• Coordinate with customers to track and complete aggressive preventative and predicative maintenance schedules.

• Build, present, and publish guardrails for approved UNIX/Linux solutions and

Storage and Enterprise Backup Services

• Provide maintenance, administration, update, configuration, integration, and documentation of NASIC’s Enterprise backup systems, SAN-attached storage systems, tape backup systems, and Network Attached Storage (NAS) systems to include firmware and software updates

• Install portal devices, update portal tables, access permissions, user accounts, roles, mapping, workspace, and devices

• Provide corrective and preventative maintenance on tape libraries, storage systems, and storage sub-systems

• Develop scripts to monitor resources and respond to adhoc user requests

• Configure storage allotments on Enterprise SAN storage, Network Attached

Storage, and modular storage

• Configure local and remote Disaster Recovery Plan (DRP) resources according to

NASIC guidelines, monitor daily data transfer status, ensure current backup of all critical data is complete, and resolve hardware and network problems that would cause connectivity issues

• Perform system restores upon request and assist Tier I support with customer file restores

• Automate all tasks using approved automation tools to include ansible, puppet, chef, Terraform, etc.

• Install, configure, maintain, and operate cloud-based storage (Dell ECS, VMware vSAN, AWS S3, Azure, etc.)

• Manage dynamic storage provisioning and provision storage as requested through customer service requests

• Manage files and directories of the file systems to include file/folder permissions

• Coordinate storage requirements with customer and assist to project future storage requirements

• Assist in the automation of monitoring and alerts from storage and backup services to CFP

• Continuously evaluate storage and backup administration processes and adopt automation and self-service capabilities to improve service delivery

• Coordinate with customers to track and complete aggressive preventative and predicative maintenance schedules.

• Build, present, and publish guardrails for approved storage and backup solutions and standards

VTC Operations

• Schedule Video Teleconferencing (VTC) sessions and provide support to attendees throughout each session

• Coordinate and verify site locations and availability, input data into VTC Wizard, verify call is scheduled and mitigate conflicts, verify the VTC starts on time and perform all communications checks with each participant prior to the sit down time for the VTC call

• Provide training and guidance to session participants on use of VTC systems

• Continuously evaluate VTC operations processes and adopt automation and self-service capabilities to improve service delivery

Multimedia Hardware Support

• Provide a wide range of installations and remedial and preventative hardware and software maintenance on various electronic equipment and network systems to include Analog/Digital Video Editing Equipment, Audio Visual Technical Support (projectors, screens, TV's, interface equipment, cameras, audio systems), Audio/Video Editing Stations, Video Teleconferencing Systems and Crestron control systems

• Provide multimedia support for conferences and special events hosted by NASIC

• Provide installation and remedial and preventative hardware and software support on the Pan/Tilt/Zoom (PTZ) Video cameras installed within the NASIC Auditorium and VTC facilities and conference rooms

• Provide maintenance, troubleshooting, and repair of the Crestron touch panels, Input/Output modules, control programmers and low voltage controllers

• Monitor the daily event logs for hardware failure

• Monitor CFP requests and respond to troubleshoot and resolve issues

• Integrate audiovisual systems and recommend technology solutions through the

CSRD process

• Install and connect DVTC systems throughout the Center

• Continuously evaluate multimedia operations processes and adopt automation and self-service capabilities to improve service delivery

Software Vulnerability Testing

• Provide software installation/configuration, software scanning, vulnerability remediation and documentation for compiled software, application source code, and containerized software – approximately 120 per year

• Provide documentation including installation instructions, vulnerability scans (pre/post), certificate to operate (CTO) reports, CTO certificate recording/tracking

• Transfer media /documentation and support CFP with software installation issues/licensing issues on an as-needed basis

• Conduct research with organization to determine Reciprocity for Certificate to Operate (CTO) process

• Coordinate with users to obtain software and troubleshoot/resolve installation issues for vulnerability scanning

• Support the NASIC DevSecOps environment

• Review and track POA&Ms for approved software

• Continuously evaluate software vulnerability processes and adopt automation and self-service capabilities to improve service delivery

Systems Engineering

• Participate in technical reviews, teams, and discussions to plan, support, and execute systems engineering requests.

• Assist and/or advise on installation, configuration, troubleshooting, technical assistance, and/or training in response to customer requirements for the IT environment

• Analyze security and regulatory compliance and make recommendations to ensure compliance, minimize security risks, and prevent or detect insider threats.

• Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation

• Build, present, and publish guardrails for approved architecture solutions and standards

• Design, develop, and plan secure designs for new or existing systems. Ensure that the design of hardware, operating systems, and software applications meets cybersecurity requirements for the system

• Research, evaluate and provide feedback on problematic IT architecture, operations, and cybersecurity trends and patterns

• Work with system engineers and administrators to jointly solve cybersecurity problems

• Develop IT architectures and designs to conform with capacity, performance and cybersecurity integrity and availability requirements. Designs will conform to DoD Architecture Framework standards

• Develop, maintain, coordinate, and update system engineering processes and procedures related to configuration management and architecture standards and changes

• Support systems integration between current and new services, operating systems, servers, and applications as required

• Provide engineering technical support and documentation for upgrades, integration, installation, implementation, and deployment for current and future products

• Provide high-level (Tier 4) troubleshooting and remediation for currently deployed systems and technologies

• Provide expert-level Group Policy analysis, design, configuration and management to support configuration management, cybersecurity, and availability requirements

• Support systems engineering branch for cybersecurity integration including role-based access control, DISA Security Implementation Guidance (STIG) implementation, OS deployment configuration, and preparing and presenting presentations, papers, and documentation, as required

• Integrate and support new and emerging technologies such as high-performance cluster computing, cloud integration, desired configuration management, automation, and database management

• Provide functional area reports weekly, summarizing work accomplished, work planned, and important issues occurring during the week

• Automate tasks using approved automation tools to include Desired State Configuration, Ansible, puppet, chef, Terraform, etc.

• Install, configure, test, and maintain network components including switches (including Cisco and Brocade), firewalls (Cisco and Palo Alto), load balancers haproxy and F5), and related network components in development, test, and integration environments

• Provide state-of-the-art techniques for designing, developing, modifying, and troubleshooting complex networks. Subject matter expert on emerging network technologies

• Serve as a senior member of the team responsible for the planning and development of a robust, scalable, and highly available network infrastructure

• Have knowledge of network and web related protocols (e.g. IPv4 and IPv6, TCP, UDP, HTTP, HTTPS, SSL, TLS, DNS, routing protocols including OSPF and

BGP)

• Provide expert support, analysis and research into complex security problems and challenges

• Ensure that the architecture and design of information systems are functional and secure

• Provide expert support for Information Technology in areas of information systems architecture, telecommunications systems design, architecture, implementation, information systems integration, software development, security engineering, and communications and network systems management

• Continuously evaluate enterprise processes and adopt automation and self-service capabilities in engineered solutions to improve service delivery

Information Technology Service Management (ITSM)

• Perform installation, configuration, troubleshooting, technical assistance and/or training in response to customer requirements for the IT Service Management tool (Currently Microsoft’s System Center Service Manager [SCSM] with plans to move to ServiceNow IT Service Management module)

• Develop, test, and troubleshoot scripts written in Microsoft Powershell.

• Support performance monitoring and situational awareness ‘dash-boarding’ for IT systems and processes within the ITSM tool

• Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation

• Assist with modifying NASIC’s self-service portal, XML management packs, and service workflows in SCSM and ServiceNow

• Assist with Standard Operating Procedure development and publish to shared repository

• Plan, install, configure, and troubleshoot ITSM tool and integration with other reporting/management tools:

o Operating systems for monitoring o ITSM Servers (SQL, SCCM, SCSM, ServiceNow) o Microsoft System Center Orchestrator and Integration Packs o Non-Microsoft third-party service management products (Provance or zenoss) o Cloud systems to include AWS, Azure, VMware, etc.

• Create, modify, and troubleshoot web dashboards Microsoft Internet Information Server (IIS) using hypertext markup language (HTML), ASP.NET, C#, and Visual Studio

• Create and modify web-based reports in SQL Server Reporting Services (SSRS).

• Provide high-level (Tier 4) troubleshooting and remediation for ITSM products and technologies on an ad-hoc basis IAW established procedures and processes.

• Automate tasks using approved automation tools within the ITSM tool to include

ServiceNow, Ansible, puppet, chef, Terraform, etc.

• Assist in the automation of monitoring and alerts from enterprise services to CFP

• Continuously evaluate ITSM processes and adopt automation and self-service capabilities to improve service delivery

Configuration Management Support

• Support NASIC configuration management policies by installing, configuring, and operating automated configuration management tools

• Aggregate and document configuration item information in the central repository.

• Populate the Configuration Management Database (CMDB) and maintain functional and allocated configuration item baselines

• Assist the Configuration Management (CM) Program Manager with maintaining and publishing the CM Concept of Operations (CONOPS)

• Assist the change management processes, procedures across 4 networks (450+ change requests/year)

• Perform configuration audits and report configuration discrepancies including production of impact analysis reports, and configuration status reports

• Integrate Security best practices in Configuration and Change Management to include establishing auditing and monitoring methods, Security Impact Analyses (SIAs) and verifying that products of the configuration management program meet cyber security requirements and maintain Authorities to Operate (ATO)

• Coordinate integration of configuration management principles into automated service delivery platforms to include SCSM, ServiceNow, VMware, and other cloud based systems such as AWS, Azure, etc.

• Automate configuration management tasks using approved automation tools to include ServiceNow, Ansible, puppet, chef, Terraform, etc.

• Assist in the automation of monitoring and alerts from enterprise services to the

CFP

• Continuously evaluate configuration management processes and adopt automation and self-service capabilities to improve service delivery

Cybersecurity

• Provide support tasks related to Security Technical Implementation Guide (STIG) implementation compliance

• Review all applicable STIG updates and work with the Risk Management process to remediate vulnerabilities

• Perform tasks as Information System Security Officer (ISSO) for NASIC systems and/or networks to include completing and coordinating packages and supporting artifacts to gain authorizations to operate (ATO) in accordance with the Risk Management Framework (RMF) and perform continuous monitoring functions to maintain ATOs

• Function as or support NASIC Information System Security Managers to execute oversight over the NASIC Cybersecurity program, implement corrective actions as necessary, and ensure compliance with IC, DoD, AF, and NASIC policy.

• Execute continuous monitoring oversight for NASIC systems (75+, to include tracking and reporting status of open plans of actions and milestones (POA&Ms) and verifying required scans, auditing, and configuration management activities are occurring

• Maintain and update AF IC and local system Assessment & Authorization repositories

• Establish and locate and maintain NASIC common security control responses and XACTA packages and the artifacts that support them

• Create and provide specialized cybersecurity training and workshops to NASIC ISSOs, privileged users, and other targeted personnel

• Assess RMF security controls for NASIC systems and networks and provide detailed security assessment reports to Delegated Authorizing Officials

• Track and monitor NASIC exceptions to and waivers from security policy

• Develop and maintain enterprise Cyber Health Dashboard to include the establishment and collection of key metrics as needed

• Host Based Security System (HBSS) support including endpoint security of 5 networks via administrative configurations, testing, analysis work, and auditing the HBSS suite (or comparable service) through modules such as Virus Scan Enterprise (VSE), Host Intrusion Prevention System (HIPS), Rogue System Detector (RSD), etc. Tasks will include analyzing logs to identify events, reviewing data transfers, developing processes to streamline analysis into Standard Operating Procedures (SOPs), documenting processes and requesting changes, preparing leadership level reports and reports to Tier 2, maintaining compliance with (Intelligence Community) IC and United States Cyber Command (USCYBERCOM) directives, and tasks as needed for HBSS events.

• Build, present, and publish guardrails for cybersecurity guidance, policy, and

Network Auditing

• Maintain and expand (as necessary) NASIC’s auditing solution (currently Elastic Search, logstash, and kibana) across NASIC’s Cornerstone Networks, in support of the IC and AF auditing requirements

• Develop and document procedures/polices for NASIC to be compliant with Auditing guidance such as ICS 500-27 (Collection and Sharing of Audit Data).

Provide technical support for any possible investigations and inquiries which may result of any misuse of information resources

• Utilize Security Information and Event Management (SIEM) software products, such as ElasticStack, to create custom queries, searches, alerts, and dashboards.

• Identify and evaluate anomalous and suspicious system and network activity, detect and assess network intrusions and malware behavior by incorporating, monitoring, and analyzing event logs across numerous device types (TCP/IP, packet analysis, Windows logs, syslogs)

• Utilize SIEM information with other tools such as ACAS, HBSS, SolarWinds, and Palo Alto.

• Identify coverage and efficiency gaps in security data and tooling.

• Notify Government Technical Monitor (GTM) of network intrusions and suspicious and anomalous events, and provide details as required within 1 business day of detection

• Provide detailed operating process and training for items related to network monitoring

• Participate in incident response and manage escalations as needed

• Monitor metrics, and trend data related to network monitoring

• Provide monthly functional area reports summarizing work accomplished, work planned in next month and important issues occurring during the month

Infrastructure as a Services (IaaS) and Cloud Operations

• Manage the VMWare environment to provide virtual resources to all NASIC missions as approved by the NASIC governance process

• Provide maintenance, administration, update, configuration, integration, and documentation of the IaaS and cloud environments

• Maintain the self-service portal to provide virtual resources to approved missions using VMware vRealize suite of tools and integration with ServiceNow

• Maintain VM blueprints (configuration, STIG, patching) for deployment in the IaaS environment

• Monitor operations of the virtual environment (vRealize Operations)

• Install, configure, maintain, and operate cloud-based servers (VMware, AWS, Azure, Google, etc.)

• Build and maintain non-pivotal base images (imagestreams, templates, Terraform/YAML, Ansible)

• Develop image change workflows and standards for development and scientific base images (Chef, Puppet, Ansible, DevSecOps)

• Monitor and manage cloud services (VMware, AWS, Azure, Google)

• Design and implement cloud services for performance and autoscaling

• Monitor runtime behavior of the services

• Manage IaaS and cloud service availability

• Request quotas and manage IaaS and Cloud resource limits. Recommend additional hardware resources for on premises IaaS system.

• Proactively evaluate IaaS and cloud applications, services, hardware, and software

• Manage and design cloud environments (AWS, Azure, Google)

• Assist with provisioning, operation, and maintenance of cloud systems (Linux, Windows, AWS, Azure, Google)

• Assist with data migration to/from cloud providers (AWS, Azure, Google)

• Design and build scalable cloud solutions

• Build and manage bootstrapping automation

• Design and automate cloud compute (EC2) storage (S3, Glacier) and resource monitoring

• Manage IaaS and cloud tenant provisioning, isolation, and capacity (VMware

NSX, VPC and Security group management)

• Design, manage, and implement quotas and Role Based Access Control (RBAC)

• Manage Enterprise cloud orchestration components (Puppet, Ansible, Chef, Kubernetes, Docker, and Terraform)

• Apply security controls to cloud technologies (manage secrets, secure CI/CD pipeline, Secure Infrastructure as Code (IaC), container security)

• Define, implement, and tune detective capabilities to detect and remediate malicious activities (cloud based container vulnerability scanning tool)

• Conduct continuous monitoring solutions to validate systems against security baselines

• Manage and design IaaS and cloud security policies

• Manage and design IaaS and cloud security package (coordinate w/16AF)

• Manage cloud task order (coordinate quarterly modifications, provide monthly status reports)

• Manage cloud resource utilization (VMware vRealize Operations, AWS cost explorer, utilization reports and alerts, manage resources across on-premises clusters and cloud-based VPCs)

• Manage cloud identity and access management (IAM policies)

• Design, deliver, and maintain automated deployments (vRealize Automation, Terraform, Ansible)

• Provide automation-oriented strategic support and advisory services

• Build tools and create Infrastructure as Code (IaC) solutions in a DevSecOps environment

• Continuously improve IaaS and Cloud processes and solutions to be scalable and highly available

• Implement automated detection and alerting of anomalous behaviors

• Design and maintain deployment pipelines (standards, quick starts, and templates)

Platform as a Service (PaaS) Operations

• Manage the platform environment to provide automated container operations for NASIC’s micro-service architecture (Linux, Containers, Pivotal Cloud Foundry, Kubernetes, Mesosphere DC/OS, Konvoy)

• Provide maintenance, administration, update, configuration, integration, and documentation of the PaaS

• Maintain the CI/CD pipeline allowing approved code to move from the unclassified development environment to be run on the classified PaaS (Chef, Puppet, Ansible)

• Maintain configuration, STIG, patching for the PaaS

• Build and maintain base images (imagestreams, templates, Terraform/YAML, Ansible)

• Manage and monitor platform quotas and resource limits

• Conduct platform application/test development and assist with user acceptance testing

• Respond to platform deployment pipeline test failures and application outages

• Design and build hardware solutions and manage bootstrapping automation

(Infrastructure as Code (IaC) tools, Chef, Puppet, Ansible)

• Perform platform cluster install and manage infrastructure services and scalability

(Pivotal Cloud Foundry, Kubernetes, Konvoy)

• Manage platform authentication and authorization

• Manage platform tenant provisioning, isolation, and capacity (RBAC, Security group management, quotas)

• Design and maintain deployment pipelines (standards, quick starts, and templates)

Database Management NASIC administers several database systems across multiple networks in support of multiple mission applications both custom and commercial. The skillset associated with database management are administrative and custodial. The skillset is not associated with Data Analytics.

• Maintain and utilize relational database systems (example Oracle, PostgreSQL, SQL, MariaDB, MySQL, etc.), No-SQL databases systems (such as MongoDB, Neo4J, Cassandra, Couch DB, etc.) and index and search systems (Elasticsearch)

• Provide expert-level database server analysis, design, configuration and management to support configuration management, operations management, application, cybersecurity, and availability requirements

• Evaluate…