RFP Attachment 1 - PWS_8.19.21.pdf

i

Defense Advanced Research Projects Agency

Mission Services Office

Security and Intelligence Directorate

Program Security Services

PERFORMANCE WORK STATEMENT

August 19, 2021 ii

TABLE OF CONTENTS

1.0. INTRODUCTION & OVERVIEW

2.0. BACKGROUND

3.0. GENERAL RESPONSIBILITIES AND EXPECTATIONS

4.0. LABOR CATEGORIES / POSITIONS

5.0. POSITION DESCRIPTIONS, QUALIFICATIONS, AND FUNCTIONS

Management/Operations Positions

5.1. Contract Program Manager (CPM)*

5.2. Other Management Positions*

5.3. Counterintelligence Analyst / Senior Counterintelligence Analyst*

5.4. Insider Threat Analyst*

5.5. Database/Web System Administrator* & Database/Web System Developer

5.6. Freedom of Information Act (FOIA) Specialist

Policy & Oversight Positions

5.7. Policy Analyst

5.8. Information & Industrial Security Specialist & Senior Specialist*

5.9. International Security Specialist & Senior Specialist*

5.10. Personnel Security Specialist & Senior Specialist*

5.11. Personnel Security Specialist – SSO

5.12. Security Administrator – Classified Document Registry (CDR)

5.13. Security Education, Training, and Awareness Specialist

Program Security Positions

5.14. Program Security Operations Manager*

5.15. Science & Technology Protection Analyst*

5.16. Countering Foreign Influence Program (CFIP) Analyst*

5.17. Cybersecurity Specialist / Program Information Technology (PIT) Security Control

Assessor (SCA)*

5.18. Program Security Representative (PSR)* / Senior PSR*

5.19. PSR Functional Area Lead (FAL)*

5.20. Security Administrator / Senior Security Administrator

SAPCO Support Positions

5.21. Program Security Representative – Executive Support*

5.22. Technical Security Support Specialist*

5.23. Senior Security Administrator – SAPCO*

iii

5.24. Security Compliance Specialists

5.25. Archivist / Records Administrator

5.26. Polygraph Examiner*

6.0. OVERTIME/TRAVEL APPROVAL

7.0. DELIVERABLES

* Denotes Key Personnel Positions - See Section 4.0.

1.0. INTRODUCTION & OVERVIEW

1.1. The objective of the DARPA Mission Services Office (MSO) Security & Intelligence

Directorate (SID) Program Security Services Contract is to provide a professional capability to perform non-inherently governmental functions related to the SID government staff in the execution of functions central to its responsibilities in preserving and enhancing

National Security objectives through integrated security processes. These services require subject matter experts skilled in their respective disciplines who can apply risk-managed, proactive program protection and related security services to the broad range of DARPA research & development projects at the fundamental research, controlled unclassified, collateral, special access program (SAP), and sensitive compartmented information (SCI) levels.

1.2. In addition to subject matter experts, an experienced, proactive contract management team is critical to supporting SID in meeting DARPA requirements through recruitment, onboarding, mentorship, and retention of highly skilled program security professionals.

1.3. All individuals supporting this contract require at the time of assignment a Top Secret personnel security clearance based on a Tier 5 or Tier 5R investigation, current within six years, and adjudicated for SCI eligibility by an authorized Central Adjudication Facility.

Individuals outside the six-year scope but entered into Continuous Evaluation with a deferred investigation meet this requirement. Some positions may require a counterintelligence scope polygraph prior to access to select programs. All personnel requiring access to SAP information must consent to a random counterintelligence scope polygraph as a condition of access. Any required polygraph examinations will be provided by DARPA.

1.4. The Contractor, and any subcontractors, must possess a Top Secret Facility Clearance at the time of proposal submission. At the time of PoP start, the Contractor must also own, lease, or otherwise control (e.g., via subcontract) office/storage space in the National

Capital Region that can be dedicated to storage of classified network backup data. This space must be at least 100 square feet in area and capable of supporting up to four GSA five-drawer containers (provided by DARPA). The space must be accredited (or constructed to applicable standards so as to be accreditable) as a Special Access Program

Facility (SAPF) and Sensitive Compartmented Information Facility (SCIF). DARPA will coordinate any necessary co-utilization agreements after contract award and prior to PoP start.

1.5. Hours and Place of Performance – Contractor support staff shall adhere to an 8-hour workday / 40-hour workweek with required core working hours of 9:00 AM until 3:00 PM

Monday through Friday. The effort will be performed at the DARPA facility at 675 North

Randolph Street, Arlington, VA 22203. Any deviations from this work schedule must be approved on a case-by-case basis by the Contracting Officer.

1.6. While performance under the contract will occur primarily at DARPA Headquarters, contract performance involves significant CONUS, and occasional OCONUS, travel. This activity is primarily associated with the Program Security Representative, Security

Compliance Specialist, and Cybersecurity/SCA positions, but all contract positions are subject to travel. Some positions may be based temporarily or permanently at remote US locations.

1.7. Observance of Legal Holidays and Facility Closures – On-site contractor support personnel shall not normally be required or authorized to work when their assigned facility is on holiday or closed. The following is a list of U.S. Federal holidays and reasons for facility closures:

a. New Year’s Day, January 1

b. Martin Luther King’s birthday, the third Monday in January

c. President’s Day, the last Monday in February

d. Memorial Day, the last Monday in May

e. Independence Day, July 4

f. Labor Day, the first Monday in September

g. Columbus Day, the second Monday in October

h. Veterans Day, November 11

i. Thanksgiving Day, the fourth Thursday in November

j. Christmas Day, December 25

k. Any other day/time designated by Federal statute, Executive Order, or Presidential

Proclamation.

As defined in DARPA Instruction No. 58, in the event of a Government site shutdown such because of inclement weather, the contractor may engage in contracting training activities or telework offsite if the contractor has a written telework policy, reviewed and approved by the Contracting Officer.

1.8. Contract performance may involve telework for select personnel/positions. The approval level for all contractor-approved telework agreements rests with the cognizant SID government lead for each employee. Each SID government lead will discuss the request with the Program Manager (PM) and Contracting Officer’s Representative (COR) and approve or disapprove in writing. Employees’ requests for telework will be evaluated on an individual, case-by-case basis. There are no minimum or maximum telework days; rather, the employee's performance, type of work, and the government needs will be considered.

1.9. Contractor personnel who support DARPA projects involving intelligence related activities are required to report any observed questionable intelligence activities or significant/highly sensitive intelligence related matters to the Director, SID as the DARPA Senior

Intelligence Oversight Officer.

2.0. BACKGROUND

2.1. DARPA’s mission is to maintain the technological superiority of the U.S. military and prevent technological surprise from harming our national security by sponsoring revolutionary, high payoff research and to create technological surprise for our adversaries.

This implies one imperative – radical innovation for national security. DARPA’s business philosophy is to bring in expert, entrepreneurial Program Managers (PMs), empower them, protect them from red tape, and quickly make decisions about starting, continuing or stopping research projects. The DARPA technical staff organization is dynamic and changes as the projected requirements of the Department of Defense (DoD), the state of technology development, and adversarial threats evolve.

2.1.1. The essence of DARPA rests within its PMs—extraordinary individuals who are at the top of their fields. These leaders come from academia, industry, military and other government agencies for limited tours, generally for three to five years. This results in

PM turnover of 20%-30% annually, and fuels the signature DARPA sense of urgency.

DARPA support staff must be capable of maintaining this urgent pace.

2.1.2. DARPA PMs address technology challenges spanning the spectrum from basic research to system-level prototypes and demonstrations, and are driven by the desire to make a difference. They define their programs, set milestones, and aggressively manage progress.

2.1.3. To support this unique program management approach, DARPA requires security personnel that are as expert in their own field as the PMs are in theirs. SID provides this support through a proactive and flexible organization led by a small cadre of government security professionals supported by contractor subject matter experts.

2.2. MSO’s mission is to provide a lean, knowledgeable, capable and adaptable staff exemplifying world-class customer service in support of the DARPA mission; supplying the tools, facilities, expertise, administrative services, and secure environment that enables the technical and administrative offices to perform their jobs as efficiently and effectively as possible.

2.3. SID’s mission is to develop, implement, and manage programs that facilitate the secure and successful accomplishment of DARPA’s mission, while protecting DARPA personnel, information, property, and business continuity. SID accomplishes this mission by planning, executing, and directing multi-disciplined security, emergency management, and counterintelligence programs. SID also formulates and implements security policy and procedures and represents DARPA on security matters across the Federal Government, defense industry, and academia.

2.4. SID’s objectives are to establish credible policy and procedures; be responsive to technical program needs in a timely manner; represent DARPA’s interests in national security forums; and, above all, protect DARPA’s people and information. SID’s challenge is to accomplish its mission and objectives while enabling the DARPA business philosophy.

SID requires a contractor that will provide a high quality, professional security staff who embody teamwork and customer service and will partner with SID to accomplish these objectives using innovative solutions to complex challenges. Just as the DARPA technical offices dynamically change to meet the Agency’s obligation to provide world-class technical vision and leadership, the SID organization must have the flexibility to provide seamless security support to the technical offices, their industry and academic researchers, and their government partners. The support needs of SID may fluctuate based on the dynamic nature of the Department of Defense, specifically the ever evolving need to ensure

DARPA is properly investing in the next revolutionary capability to create or avoid strategic surprise. It is anticipated that support requirements, in-scope of the contract, may increase throughout the period of performance based on changes in leadership focus (e.g., DoD, USD(R&E), & DIRO), adversary capabilities, and other internal and external factors.

2.4.1. The ability of a support contractor to successfully perform in the DARPA environment is entirely dependent on the intelligence, experience, and work ethic of its personnel. SID requires program security personnel who are not paralyzed by the unknown or unfamiliar, who are subject matter experts across multiple disciplines, and who possess critical thinking and analytical problem-solving skills. The

Contractor staff must foster the creation of innovative security solutions to support program timelines and objectives, while maintaining compliance with applicable national security requirements.

2.4.2. SID also requires program security personnel who are experienced in the creation, application, and execution of security risk management tools, processes, and procedures in support of S&T/RDT&E programs. Program security personnel must possess the experience and skills necessary to ensure proper security during program inception and execution, as well as ensure the security structure will enable rather than hinder successful transition to service and agency partners for acquisition and fielding.

2.4.3. Paramount to SID support of the DARPA mission is the concept of completed actions. DARPA’s pace does not provide time for re-work or multiple iterations of administrative tasks. Therefore, the Contractor must ensure that all work products contain necessary content, use proper spelling and grammar, and are executed in accordance with DARPA and/or DoD style and format guidance.

2.5. DARPA recognizes the highly competitive labor market in the National Capital Region places a premium on experienced, knowledgeable security professionals with the knowledge, skills, abilities and clearances required to meet DARPA requirements. The

Contractor must be fully cognizant of the unique DARPA program security environment, and must be capable of recruiting and retaining high-quality personnel and providing thoughtful, responsive, and customer-oriented management.

3.0. GENERAL RESPONSIBILITIES AND EXPECTATIONS

3.1. The Government requires full-time support in a number of security discipline functions as described in this PWS. This section addresses general skills, abilities, and functions applicable to all contract positions. Specific labor categories/positions are listed in Section

4.0, Position descriptions, associated education and experience requirements, and core functions are detailed in Section 5.0.

3.2. All contract personnel are expected to:

3.2.1. Possess the energy, experience, and subject matter expertise to demonstrate sound judgment, foresight, and problem-solving skills in a fast-paced S&T/RDT&E environment.

3.2.2. Possess excellent oral and written communication skills, demonstrating the ability to communicate and interact efficiently and effectively with individuals from a wide variety of backgrounds, education levels, and organizational affiliations.

3.2.3. Possess proficiency in standard office programs/software, and to rapidly gain proficiency in a variety of specialized DARPA-specific databases and software tools.

3.2.4. Possess excellent research and data-gathering skills and an ability to interpret and analyze complex information.

3.2.5. Work independently, as well as in a team environment, within the bounds and guidelines of the organization.

3.2.6. Actively participate in meetings (local, out-of-area, and voice/VTC) and create meeting summaries and/or trip reports.

3.2.7. Prepare and present briefings to or on behalf of SID government staff, using presentation tools and incorporating graphics as needed.

3.2.8. Perform self-inspections, identify discrepancies, and report security incidents.

3.2.9. Perform or support security reviews/inspections at industry locations, identify security discrepancies, and prepare reports.

3.2.10. Perform courier duties within the continental United States (CONUS) and outside the continental United States (OCONUS).

3.2.11. Perform user-level information security responsibilities as required and in compliance with applicable laws, executive orders, and DoD and DARPA policy.

3.2.12. Review and provide feedback on security-related policies and procedures.

3.2.13. Prepare and submit various DARPA and/or DoD forms.

3.2.14. Assist in entry control and perform escort duties for visitors.

3.2.15. Answer telephones, email, and other modes of administrative communications.

3.2.16. In conjunction with other contract subject matter experts, perform quality control

(QC) reviews of work products. These QC reviews will encompass technical content, critical thinking, analysis, problem-solving, proper spelling/grammar, and proper delivery format (including required reference/back-up materials) to ensure the highest professional standards are applied.

3.3. The Director, SID may also task contractor staff to address issues that encompass the responsibilities of multiple SID functions (i.e., cross-functional “tiger” teams). These tasks may be assigned to a single individual or to a group (contractor only or mixed government/contractor), and typically require extensive knowledge of security disciplines and understanding of DARPA missions, functions, and organization.

4.0. LABOR CATEGORIES / POSITIONS

The following labor categories/positions are required for performance under this contract.

Those marked with (*) are designated as key personnel. Prior to substituting, removing, replacing, or otherwise diverting the activity of any of the key individuals specified below, the

Contractor shall notify the COR in writing at least 15 calendar days in advance, unless compelling circumstances exist otherwise, and include information supporting the need for change. The proposed substitution of personnel must meet or exceed the qualifications of the current key personnel, as determined and agreed to by the COR or Contracting Officer.

Resumes shall be submitted to the COR for all candidates for positions designated as Key

Personnel for review prior to assignment to the contract. The COR may refuse to accept the candidate if the resume does not indicate that the person is qualified to do the work specified on the contract per the descriptions below. The COR may request to meet the candidates as part of the review process. If the COR refuses to accept the person, the burden for proving that the person is qualified for the proposed position rests on the Contractor.

The COR or Contracting Officer may request replacement of Key Personnel at any time.

Management/Operations Positions

4.1. Contract Program Manager*

4.2. Other Management Positions (if applicable)*

4.3. Counterintelligence Analyst & Senior Analyst*

4.4. Insider Threat Analyst*

4.5. Database/Web System Administrator* & Database/Web System Developer

4.6. Freedom of Information Act Specialist

Policy & Oversight Positions

4.7. Policy Analyst*

4.8. Information/Industrial Security Specialist & Senior Specialist*

4.9. International Security Specialist & Senior Specialist*

4.10. Personnel Security Specialist & Senior Specialist*

4.11. Personnel Security Specialist – Special Security Office (SSO)

4.12. Security Administrator - Classified Document Registry (CDR)

4.13. Security Education, Training, Awareness Specialist

Program Security Staff

4.14. Program Security Operations Manager*

4.15. Science &Technology Protection Analyst*

4.16. Countering Foreign Influence Program Analyst*

4.17. Cybersecurity Specialist/Platform Information Technology Security Controls Assessor*

4.18. Program Security Representative* & Senior Program Security Representative *

4.19. Program Security Representative Functional Area Lead*

4.20. Security Administrator & Senior Security Administrator

SAPCO Support Staff

4.21. Program Security Representative - Executive Support*

4.22. Technical Security Support Specialist*

4.23. Security Administrator - Senior (SAPCO)*

4.24. Security Compliance Specialist

4.25. Archive/Records Administrator

4.26. Polygraph Examiner*

5.0. POSITION DESCRIPTIONS, QUALIFICATIONS, AND FUNCTIONS

The following paragraphs provide detailed position descriptions, education/experience qualifications, and key functions for each labor category. The Contractor may propose candidates who do not meet the minimum requirements for a specific labor category by providing rationale why the candidate’s unique skills and/or experience warrant a waiver of the stated requirements. Waivers may be granted at the discretion of the COR, in consultation with relevant SID government staff and the Contracting Officer. Metrics for task/product volume and timelines for submission are included for some specific tasks. SID government staff will set metrics and timelines as necessary for day-to-day operations within the scope of the PWS.

In addition to the emphasis on quality of products, adherence to established submission timelines will be a major consideration in the evaluation of contract performance.

Management/Operations Positions

5.1. Contract Program Manager (CPM)*

Responsive and collaborative management is crucial to successful performance on the contract. While a robust corporate support structure will be necessary, the CPM is the primary interface to the Government for all matters associated with execution of the contract. DARPA expects the onsite CPM to be vested with full autonomy and authority to select, hire, manage, and dismiss personnel as needed to maintain the high standards and fast pace of the DARPA environment. Recruitment and retention of high-quality personnel will be a primary factor in evaluation of Contractor performance.

The CPM requires a bachelor’s degree with 12 years of qualifying, related experience, or an associate degree with 15 years of qualifying, related experience. Qualifying, related experience includes demonstrated recent experience managing a multi-discipline security organization providing support to the Federal Government in a classified program environment (DoD or Intelligence Community preferred). Five years of this experience must be in the direction and management of 75 or more personnel on a Federal

Government support contract, in defense industry supporting Federal Government funded programs, as a Federal Government civilian, or in military service. Specific management experience in a research & development environment is highly desired.

The CPM must also possess expert leadership and mentorship traits, and the ability to communicate effectively and efficiently within the contract and with DARPA government staff.

The CPM is responsible for the following functions:

5.1.1. Ensure the timely and effective recruitment, onboarding, training, logistics support (to include travel), and retention of high-quality personnel for all contract positions, with particular emphasis on the PSR staff, who represent the largest labor category and are the closest contract staff to the DARPA PMs, performers, and government partners.

5.1.2. Notify the COR and Director, SID of employee resignations within two business days.

5.1.3. Notify the COR and Director, SID as soon as practicable of any decision to remove contract personnel for inappropriate workplace behavior or any issue that affects clearance or access eligibility.

5.1.4. Provide weekly status updates to the COR for all vacant positions.

5.1.5. Coordinate key personnel vacancies with the SID government lead responsible for oversight of the vacant position, in addition to the COR.

5.1.6. Proactively engage and support the SID leadership team and keep them apprised of any issues that may affect SID operations and activities.

5.1.7. Ensure proper accounting, inventory, purchase, and disposition of government-furnished equipment and other consumable materials.

5.1.8. Oversee the submission of deliverables listed in Section 7.0 of this PWS, to include presentation of monthly metrics to the COR and Director, SID.

5.2. Other Management Positions*

5.2.1. Other Management Positions may be proposed by the Contractor as part of their management structure (e.g., Deputy PM, Supervisor, Lead).

5.2.2. If the Contractor elects to include Other Management Positions, candidates for those positions must have demonstrated experience in directing, coordinating, scheduling, and supervising the activities of professional security personnel in a multi-faceted security program in a classified environment. It must also be clear as to whether duty titles such as “Lead” or “Deputy PM” are an additional duty placed on an individual fulfilling one of the identified labor categories, or are considered a full-time management position.

5.2.3. Personnel filling Other Management Positions require a bachelor’s degree with six years of qualifying, related experience or an associate degree with 10 years of qualifying, related experience in the particular area(s) they will manage/lead. Three years of experience must be in the direction and management of five or more personnel supporting Federal Government funded programs.

5.2.4. Other Management Position candidates must possess and demonstrate leadership qualities and capabilities such as mentorship, quality control assessment, conflict resolution and strong written and verbal communications skills.

5.3. Counterintelligence Analyst / Senior Counterintelligence Analyst*

The Counterintelligence Analyst requires a bachelor’s degree and four years of related experience or no degree and six years of related experience. The Senior Counterintelligence

Specialist position requires a bachelor’s degree and 10 years of related experience or no degree and 15 years of related experience.

The Senior CI Analyst must possess the knowledge, experience and leadership ability to effectively set priorities, balance workload, conduct quality control of work products, and advise/mentor the Analysts under their supervision.

CI Analysts must also possess subject matter expertise in a broad spectrum of CI related areas including, but not limited to:

• Understanding the IC organizational composition, including the roles and responsibilities of the IC components.

• Methodologies inherent in Insider Threats.

• Elicitation and counter-elicitation methods and procedures.

• CI indicators of motivation.

• Methods of information collection and information transmittal.

• Methodologies employed in Competitive Intelligence and Economic Espionage practices.

• Foreign intelligence/CI threat data and the agencies acquiring it (including general, site-specific, and technical).

• Implications to S&T program efforts from various CI threats, and prioritizing and counteracting such threats.

CI Analysts are responsible for the following functions:

5.3.1. Determine essential elements of information and conduct activities to detect, identify, assess, exploit, and proactively counter or neutralize hostile intelligence collection, sabotage, and terrorist activities.

5.3.2. Plan and execute special analytical projects as assigned, including determining the most effective analytical approach and assessment criteria, creating a schedule, identifying requirements for personnel, data collection, travel, and estimating costs.

5.3.3. Research and collect required data, perform analyses, and summarize findings in response to customer requests.

5.3.4. Compile detailed reports of analyses, clearly defining the problem or issue, factors considered, findings, and providing clear, concise conclusions and recommendations.

5.3.5. Assist Program Security Officers (PSOs), PSRs, and PMs in developing program lifecycle threat analyses and Program Protection Plans.

5.3.6. Apply analytical methodologies to existing programs to review and reassess, if necessary, their protection needs to remain consistent with changes in diplomatic, political, and military environments.

5.3.7. Assess and postulate international diplomatic, political, and military responses to proposed program actions and activities.

5.3.8. Perform short-notice contingency and exposure analyses, summarizing implications, and providing viable responses and recommended courses of action.

5.3.9. Work with individual program management personnel to assist in analyzing and developing solutions to unique or difficult CI-related issues.

5.3.10. Review organizational mission statements and other publicly available program information on DARPA programs and performers for inconsistencies that may reveal sensitive information.

5.3.11. Review, analyze, and, where appropriate, make recommendations to program protection policies and practices.

5.3.12. Provide threat data and analyses to support technology assessments.

5.3.13. Assist in the identification of critical program information (CPI) and assist in the development of program protection and OPSEC plans.

5.3.14. Participate, as appropriate, in program management and planning meetings and working sessions.

5.3.15. Receive and act on information of CI value from polygraph examinations, foreign travel/contact reports, technical security inspections, international cooperation or international security reports, visitor control records, Anti-Terrorism/Force Protection data, or other sources of potential Foreign Intelligence Service or CI related activity.

5.3.16. Prepare and deliver comprehensive briefings to increase CI awareness among Agency personnel.

5.3.17. Establish lines of communication and professional relationships within DoD and with other Federal agencies to support and enhance DARPA’s organic CI program.

5.3.18. Coordinate with the DARPA Executive Agent for CI on CI program activities and provide actionable information and leads for further action as appropriate.

5.3.19. Evaluate, interpret, and utilize foreign intelligence/counterintelligence threat data and the implications to DARPA programs from those various threats.

5.4. Insider Threat Analyst*

The Insider Threat (InT) Analyst requires a bachelor’s degree and four years of related CI analyst or program security experience or an associate degree and six years of related experience. The Insider Threat Analyst must possess demonstrated successful experience in support of DoD or IC InT programs.

The Insider Threat Analyst must also possess subject matter expertise with the requirements of Executive Order 13587, the Executive Branch Minimum Standards, and

DoD regulations/guidance regarding InT.

The Insider Threat Analyst is responsible for the following functions:

5.4.1. Correlate, analyze, and organize various data streams, triggers, and anomalous behaviors in order to provide SID and InT team leadership with baselines, items of interest, and focus issues.

5.4.2. Communicate across the DoD, IC, and National Insider Threat Task Force (NITTF) in support of DARPA InT initiatives.

5.4.3. Coordinate, implement, and oversee the proper execution of user activity monitoring tools, monthly audits of removable media and US Cyber Command required actions, as well as Key Information Security System Indicators.

5.4.4. Oversee, coordinate, and plan the annual report to the Agency InT Program Manager, Senior Agency Official, and Agency Director.

5.4.5. Plan for, coordinate, and execute the annual InT Risk Assessment, as well as Insider

Threat Compliance Inspections by the National Insider Threat Task Force and Office of the Under Secretary of Defense for Intelligence & Security (OUSD(I&S)) Security

Policy Oversight Division.

5.4.6. Collaborate with the DARPA Information Technology Directorate (ITD) to establish baseline user activity, monitoring behaviors, triggers, and anomalous behavior indicators.

5.5. Database/Web System Administrator* & Database/Web System Developer

The Database/Web System Administrator and Developer requires a bachelor’s degree in a computer science or information system field of study and eight years of qualifying, related experience. A master’s degree in a computer science or information system field of study may substitute for four years of experience. Qualifying, related experience includes demonstrated recent experience in performing such functions on a Federal Government contract or in a Federal Government organization, and includes an understanding of database system standards, methodologies and business applications. The Database/Web

System Administrator and Developer must have demonstrated experience in performing database management system (DBMS) administrator activities in a classified environment.

The Database/Web System Administrator must possess the knowledge, experience and leadership ability to effectively set priorities, balance workload, conduct quality control of work products, and advise/mentor the Developers under their supervision.

Database/Web System Administrators & Developers are responsible for the following functions:

5.5.1. Map out the conceptual designs for planned databases in an outline form and write database documentation, including requirements, data standards, scripts, procedures, and definitions for the data dictionary.

5.5.2. Maintain proficiency in various products including, but not limited to:

• Microsoft Access

• Structured Query Language (SQL) 2008R2/2012/2014

• Oracle

• C# and C++

• Visual Studio 2013

• Microsoft Entity Framework

• LINQ scripting

• T-SQL scripting language

• ASP.net development platform

• Microsoft IIS 8.0

• W3C standard web application scripting languages and interchanges (HTML, CSS, Java and JavaScript, Ajax, XML, and JQuery)

• Microsoft Visual Studio

• Microsoft Entity Framework

• SQL Server

• Spotfire

• SPLUNK

5.5.3. Plan and execute the maintenance, upgrades, trouble-shooting, and interconnectivity of the SID Security Control Suite (SCS) database, coordinating and collaborating as needed with the DARPA Information Technology Directorate (ITD) and the Georgia

Tech Research Institute (or their successor) on various SID database initiatives.

5.5.4. Establish user needs and monitor user access and security while working collaboratively with peers in ITD to facilitate database hosting, support, patching, power, and back-ups.

5.5.5. Monitor performance and manage parameters to provide fast query responses to front-end users. Communicate regularly with onsite technical, applications, and operational staff to ensure database integrity and security.

5.5.6. Refine system logical designs to support translation into a specific data model. Refine the physical design to meet system storage requirements, and coordinate installations and testing for new versions of the database management system.

5.5.7. Participate in peer code reviews and technical meetings to ensure applications under development meet Security Technical Implementation Guide (STIG) requirements.

5.5.8. Analyze the data stored in the databases and make recommendations regarding data storage performance and efficiency.

5.5.9. Support critical business operations through scheduled and dynamic requests, receipt, and transmission of data to internal and external customers and partners as requested.

5.5.10. Oversee requirements gathering sessions, assimilate information, and maintain effective internal data standards and capabilities to meet customer expectations.

5.5.11. Ensure that all system users are trained in the use of the database systems.

5.5.12. Develop/sustain an audit program to verify the accuracy of data entry.

5.5.13. Coordinate maintenance and repair activities for the applicable databases, applications, systems, and networks.

5.5.14. Maintain an inventory and configuration control file of the database systems and ensure maintenance, software upgrades, data archiving, and tests are conducted to assure the systems function at peak efficiency and that historical data is not lost.

5.5.15. Review and recommend requirements to assess, disposition, and/or upgrade, technology and software.

5.5.16. Design, develop, program, test, and debug new software and upgrades to existing software using VB.net or others as appropriate.

5.6. Freedom of Information Act (FOIA) Specialist

Freedom of Information Act (FOIA) Specialists require an associate degree with five years of related experience or no degree with eight years of experience in processing FOIA cases in an Executive Branch agency. The FOIA Specialists must have the capability and demonstrated knowledge of FOIA paralegal procedures such as appeals and litigation concepts, competent technology skills dealing with FOIA Xpress, and successful experience in performing research activities.

FOIA Specialists are responsible for the following functions:

5.6.1. In conjunction with the DARPA External Relations Office and General Counsel, recommend implementation of Agency-wide FOIA policies and procedures, including updates based on new or revised legislation or recommendations.

5.6.2. Receive, log, suspense, and monitor FOIA requests received from DoD to ensure processing in accordance with guidance contained in DoD Directive 5400.07, DoD

Freedom of Information Act (FOIA) Program.

5.6.3. In coordination with the DARPA General Counsel and External Relations Office, interpret regulations and Agency policy regarding release of information under the

FOIA for DARPA personnel.

5.6.4. Develop and recommend refinements to FOIA projects and keep abreast of these projects, providing the capability to support DARPA compliance with the Electronic

Freedom of Information Act Amendments of 1996 (E-FOIA).

5.6.5. Develop and apply the guidance associated with the Freedom of Information Act restrictions on dissemination/withholding of material to the public, principles of classification as embodied in Executive Orders, DoD Directives and Instructions, and

Security Classification Guides.

5.6.6. Collect, organize, and analyze qualitative and quantitative data needed for annual reporting of FOIA activities for DARPA FOIA actions.

Policy & Oversight Positions

5.7. Policy Analyst

The Policy Analyst requires a bachelor’s degree and 10 years of related DoD or IC program security experience or an associate degree and 12 years of related experience. Qualifying, relevant experience includes demonstrated successful and recent experience in performing such functions on a contract or in an organization that provides security policy oversight, interpretation, application, advice, and assistance to the DoD, IC, or defense industry.

Related experience in researching and developing security guidance, policy, and analytical products is also required.

The Policy Analyst is responsible for the following functions:

5.7.1. Research and collect required data, perform analysis, and summarize findings in response to changes in policy (internal and external to DARPA).

5.7.2. Draft, coordinate, and maintain currency of comprehensive SID guidance.

5.7.3. Compile detailed reports of analysis which include clearly defined problems or issues, factors considered, findings, and provide clear, concise conclusions, and recommendations.

5.7.4. Develop innovative and proactive analytical methodologies or refine existing program methodologies to meet evolving needs.

5.7.5. Review, analyze, and make recommendations to SID plans, policies, and procedures.

5.7.6. Review and provide comments on other planning documentation as required; draft position papers and other planning documentation, and develop comprehensive briefings to inform SID and DARPA leadership.

5.7.7. Develop a thorough understanding of DARPA, its technology thrusts, and the DoD organizational structure.

5.7.8. Maintain an up-to-date database of current DoD security policy and procedures, as well as the SID Program Security Tool Kit.

5.7.9. Maintain and keep current the SID Program Security Tool Kit One-Note application ensuring that new policies are properly categorize and summarized for users.

5.7.10. Review changes to or issuances of new DoD security policy documents within five business days of promulgation, and create reports of projected impact to DARPA for the Assistant Director, Policy and Oversight, and the Director, SID.

5.7.11. Manage the SID suspense tracking program. Coordinate with subject matter experts across the DARPA organization and functional areas to prepare comprehensive responses to suspense actions assigned to SID.

5.8. Information & Industrial Security Specialist & Senior Specialist*

Information/Industrial Security Specialists require a bachelor’s degree and five years of related experience, or no degree and eight years of related experience. The Senior

Information/Industrial Security Specialist requires a bachelor’s degree and 10 years of related DoD or IC program security experience, or no degree and 12 years of related DoD or IC experience. Relevant experience includes performing information and industrial security activities including, but not limited to: Special Security Agreements, Voting

Trusts, Proxy Agreements, DD 254 Contract Security Classification Specifications, National Interest Determinations (NIDs), and Manual Declassification review processes.

The Senior Information/Industrial Security Specialist must possess the knowledge, experience and leadership ability to effectively set priorities, balance workload, conduct quality control of work products, and advise/mentor the Specialists under their supervision.

Information & Industrial Security Specialists are responsible for the following functions:

5.8.1. Conduct ongoing assessment of current DoD and DARPA policy and practices for the protection of classified and controlled unclassified information (CUI) and make recommendations for improvements.

5.8.2. Oversee the development, preparation, and quality control for all DD 254s, Contract

Security Classification Specifications, for DARPA-funded efforts, regardless of contracting agent, and assist PSOs and PSRs with determining appropriate security requirements for contract efforts. Process DD 254s for approval and dissemination to appropriate offices within five business days of receipt.

5.8.3. Advise DARPA personnel on the application of appropriate classification markings.

5.8.4. Manage the Mandatory Declassification Program and prepare recommendations for the Director, SID (and Director, SAPCO for SAP information) to submit to the

DARPA Director as Original Classification Authority. Coordinate declassification actions with the appropriate DARPA technology office and their respective security staff within five business days of receipt of task. Prepare formal declassification decision recommendation memorandums for the DARPA Declassification Authority at least five business days prior to the established deadlines set by the formal tasker.

5.8.5. Review material to determine the appropriateness of release to the public.

5.8.6. Develop and implement programs for controlling and destroying classified and controlled unclassified information.

5.8.7. Oversee and support the development, preparation, quality control, and staffing of security classification guides (SCGs). Conduct quality control reviews within three business days of receipt of SCGs for staffing and ensure the Office of Primary

Responsibility (OPR) is notified of necessary corrections (if necessary) within two additional business days. Ensure SCGs passing quality control and classification management requirements are staffed to the Director or Deputy Director, SAPCO within five business days of receipt.

5.8.8. Maintain metrics for all SCGs and their staffing life cycle from receipt from the technical office through signature by the OCA, including the number of business days at each reviewer level.

5.8.9. Develop, prepare, and coordinate National Interest Determinations (NID) in accordance with DoD timelines (e.g., 30 business days for Component coordination/decision).

5.8.10. Prepare sponsorship documentation and liaison with the DCSA Facility Clearance

Branch and subsequent Regional Offices to coordinate the granting of facility security clearances (FCL), including interim FCL, within five business days of notification of the requirement from the respective PSR or PSO.

5.8.11. Process and document administrative termination or downgrading of an FCL.

5.8.12. Monitor events requiring FCL invalidation, revalidation, or revocation, including

FCLs issued in error, and notify affected PSR(s) and PSO(s) as appropriate.

5.8.13. Establish, organize, and maintain the facility files folders, documenting all changing conditions affecting an FCL.

5.8.14. Provide advice to PSOs and PSRs regarding program performance at facilities located on a Government installation.

5.8.15. Coordinate with SID Personnel Security and DCSA to facilitate personnel clearances required in connection with FCL applications.

5.8.16. Review applicable documentation and make a recommendation to SID leadership regarding impacts of a U.S. company performing on DARPA efforts while/if under

Foreign Ownership, Control, or Influence (FOCI).

5.8.17. Research and make recommendations on potential impacts on a Contractor’s eligibility for initial or continued access to classified information.

5.8.18. Prepare for and support inspections by oversight agencies such as Information

Security Oversight Office (ISOO) and the Office of the Under Secretary of Defense for Intelligence & Security (OUSD(I&S)) Security Policy Oversight Division.

5.8.19. Develop and submit required annual reports, such as the Senior Agency Official Self-

Inspection and SF-311 Annual Report.

5.8.20. Research foreign ownership or controlling influence (FOCI), in whole or in part, for performers and/or prospective performers on DARPA efforts.

5.8.21. Execute the security inquiry program, ensuring all reports of inquiry (ROI) are properly conducted and documented IAW DoDM 5200.01 established timelines.

5.8.22. Coordinate and validate International Atomic Energy Act (IAEA) compliance inspections, Open Skies Treaty overflights, and other treaty compliance actions that could affect DARPA facilities, test activities, or programs.

5.9. International Security Specialist & Senior Specialist*

International Security Specialists require a bachelor’s degree with four years of related experience or an associate degree with six years of related experience. The Senior

International Security Specialist requires a bachelor’s degree with eight years of related experience or an associate degree with 12 years of related experience.

The Senior International Security Specialist must possess the knowledge, experience and leadership ability to effectively set priorities, balance workload, conduct quality control of work products, and advise/mentor the Specialists under their supervision.

International Security Specialists are responsible for the following functions:

5.9.1. Prepare materials and documents required for assessing the exchange of information with foreign governments, foreign nationals, and international organizations to assure compliance with requirements in the National Disclosure Policy (NDP), Arms Export

Control Act (AECA), Export Administration Regulations (EAR), and other relevant policies, statutes, and instructions, provide rationale and recommendations for release or non-release decisions.

5.9.2. Determine, recommend, and prepare input relative to properly managing and complying with various treaty compliance issues and inspections pertinent to DARPA programs including, but not limited to: the New Strategic Arms Reduction Treaty

(New START), Chemical Warfare Compliance (CWC) Treaty, Strategic Arms

Reduction Treaty I and II (START I and II), Biological Weapons Convention (BWC)

Treaty, and the Treaty on Open Skies (OS).

5.9.3. Develop an understanding of the nature and extent of pertinent bilateral and multilateral security and information exchange agreements that apply to DARPA programs and technical areas.

5.9.4. Assist Program Managers, where required, in the application of the Department of

State Form DSP-85, Application/License for Permanent/Temporary Export or

Temporary Import of Classified Defense Articles and Classified Technical Data, for

DARPA activities.

5.9.5. Coordinate, apply, and ensure compliance with the procedures for the international transfers of classified material and the release of U.S. classified material to foreign governments/persons.

5.9.6. Determine, recommend, manage, and prepare input regarding DARPA’s adherence to

DoD requests for analysis regarding Committee on Foreign Investment in the United

States (CFIUS) cases.

5.9.7. Working with SID Industrial/Information Security, determine whether U.S.

companies engaged in DARPA efforts, or proposed as potential DARPA performers, are under Foreign Ownership, Control, or Influence (FOCI), to include the nature and extent of FOCI, in whole or in part, by a foreign government.

5.9.8. Implement FOCI case processing guidance and procedures.

5.9.9. Assist DARPA PMs and SETAs in drafting Technical Assistance Agreements.

5.9.10. In coordination with the Industrial/Information Security Section, maintain awareness of firms engaged in DARPA efforts or proposed as potential DARPA performers, as well as their compliance with pertinent U.S. laws, regulations, and contracts.

5.9.11. Review material and make recommendations relative to its appropriateness for public release, with special emphasis on those that may possess export controlled or

International Traffic in Arms Regulations (ITAR) information.

5.9.12. Monitor visits and visit requests to DARPA by foreign nationals, ensuring requests to visit are processed through proper channels and, as appropriate, that any assignments of foreign nationals are processed in accordance with the Defense Personnel

Exchange Program (DPEP) agreements or the International Visit Program (IVP), providing rationale for approving or rejecting the visit.

5.9.13. Working with the Director, SAPCO, identify issues relative to DARPA SAP activities and their relationship in context to treaty compliance options to adhere to or challenge treaty language.

5.9.14. Recommend and prepare proposed changes to policy, directives, treaties, and/or security implementation to address compliance issues.

5.9.15. Assist in the development, review, and execution of Treaty Compliance Plans (TCPs).

5.9.16. Maintain current International Arms Control Agreements and treaties that apply to

DARPA efforts.

5.9.17. Maintain current documentation associated with the Defense Treaty Inspection

Readiness Program (DTIRP).

5.9.18. Apply to international security issues involving DARPA efforts or information those elements governed by the Atomic Energy Act of 1964, and the handling of Restricted

Data (RD), Formerly Restricted Data (FRD), and Critical Nuclear Weapons Design

Information (CNWDI).

5.9.19. Provide advice and assistance to the Foreign Disclosure Officer and DARPA Program

Managers regarding international contracts/collaboration with foreign governments involving classified information.

5.9.20. Provide advice to DARPA staff on the following:

• Bilateral Security Agreements

• Project Arrangements

• Industrial Security Agreements

• Export Authorizations

• Manufacturing License…