J002 - Labor Category Descriptions and Qualifications_FINAL SIR 693KA8-20-R-00017.docx

Table of Contents

Attachment J002 Labor Category Descriptions and Qualifications

Attachment J002 Labor Category Descriptions and Qualifications

FINAL SIR, Cybersecurity Testing

693KA8-20-R-00017

Labor Category Descriptions and Requirements This section provides the position descriptions and minimum education, certification, and experience requirements for the labor categories listed in the table below.

Program Manager

Fifteen (15) years experience managing technical programs/projects and supervising staff member activities.

At least three (3) years Government contracting experience within the 15 years relevant experience is required.

Project Management Professional (PMP) certification is desired, but not required.

Cyber Security Analyst

Performs assessments of systems and networks within the network environment or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Plans, prepares, and executes tests of systems to evaluate results against specifications and requirements as well as analyze/report test results.

and at least one of the risk assessment certifications listed in Section 3.

and at least one of the risk assessment certifications listed in Section 3.

10 years experience related to the work/responsibilities outlined in the Position Description

and

5 years experience related to the work/responsibilities outlined in the Position Description

Subject Matter Expert (Penetration Testing)

Certifications

Performs penetration testing of the ATO NAS security posture to provide detailed analysis and identification of application, system, and network vulnerabilities; gaps in IT security guidance, and assessment of patching/mitigation methodologies.

Acts as Ethical white hat attacker (red teamer) to simulate cyberattacks, and/or Defensive cybersecurity personnel (blue teamer) to harden against simulated attacks.

Develops and prepares penetration testing Rules of Engagement, test plans, and reports.

Provides recommended remediation actions to lower overall risk exposure, as required

Provides technical expertise on penetration testing tools and simulation environment

and

A minimum of 2 of the Red Teaming certifications or 2 of the Blue Team Certifications listed in Section 3.

10 years’ experience related to the work/responsibilities outlined in the Position Description

If required, the Government may request additional specialized experience relevant to the environments or system being tested.

At least 2 years of the relevant experience must be recent, i.e. performed within the last 3 years

and

A minimum of 2 of the Red Teaming certifications or 2 of the Blue Team Certifications listed in Section 3.

8 years’ experience related to the work/responsibilities outlined in the Position Description

Cyber Security Engineer

and at least one of risk assessment certifications listed in Section 3.

At least 2 years of the relevant experience must be recent, i.e. performed within the last 3 years

and

10 years’ related to the work/responsibilities outlined in the Position Description

and

5 years’ experience related to the work/responsibilities outlined in the Position Description

Information System Security Developer

Designs, develops, tests, and evaluates information systems throughout the systems development life cycle.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Conceptualizes, designs, procures, and/or builds secure information technology (IT) systems, with responsibility for aspects of system and/or network development.

10 years’ experience related to the work/responsibilities outlined in the Position Description

5 years’ experience related to the work/responsibilities outlined in the Position Description

Information System Security Analyst

Conceptualizes, designs, procures, and/or builds secure information technology (IT) systems, with responsibility for aspects of system and/or network development.

Develops and conducts tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of systems or elements of systems incorporating IT.

Designs, develops, tests, and evaluates information systems throughout the systems development life cycle.

Analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

Technical Writer

Contract Technical Support

Supports a variety of technical tasks related to the Contract.

Provides logistics, configuration, installation, technical expertise, and troubleshooting support on laptops, applications, software, and other systems used for cybersecurity testing and assessment.

Initiates and tracks the purchase of new hardware and software used for cybersecurity testing/assessments, and maintains a current inventory of all assets.

Attends meetings to analyze, troubleshoot and diagnose hardware problems.

Assists in developing training materials, e.g. quick reference guides, FAQs, etc., and provides training to help users get started or become familiar with hardware and applications.

Associates’ Degree in a technical field of study or

High School degree and a certificate from an accredited institution that is work to be performed

5 years experience related to the work/responsibilities outlined in the Position Description

As required, the Government may add a preference for experience with specific hardware/software

Administrative Support

Provides general administrative support necessary for cybersecurity testing activities and deliverables.

Administrative tasks may include maintaining the security testing schedule; preparing and sending status reports and communications; scheduling and locating meeting resources; assisting with travel arrangements for off-site testing; and preparing reports and presentations.

Bachelor’s Degree

Familiarity with Adobe Acrobat, Microsoft Project, and remote meeting platforms such as Zoom or Microsoft Teams, and is desired, but not required.

Allowable Substitutions

· A Master's degree in an appropriate discipline will be considered equivalent to two (2) years of relevant experience. A doctoral or Ph.D. degree in an appropriate discipline will be considered equivalent to four (4) years of relevant experience.

· Eight (8) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to a Bachelor's degree.

· Six (6) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to a Bachelor's degree, when combined with a certification listed in Section 3 or equivalent certification not already required.

· Three (3) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to an Associate’s degree.

· An accredited bachelor’s or Master’s degree not listed or not considered equivalent will be counted as one (1) year of relevant experience; an accredited Ph.D. degree not listed or not considered equivalent will be counted as (2) two years of relevant experience.

· Five (5) additional years of project management experience will be considered equalivent to a Project Management Professional (PMP) certification.

· Any other substitutions for Certification requirements must be submitted for approval by the Government

Certification Requirements Risk Assessments One or more of the following certifications are required.

· Certified Information Systems Security Professional (CISSP)

· GIAC Certified Enterprise Defender (GCED)

· CompTIA Advanced Security Practitioner (CASP)

· Certified Information Systems Auditor (CISA)

Penetration Testing - Red Teaming Two or more of the following certifications are required:

· Offensive Security Certified Professional (OSCP)

· Offensive Security Certified Expert (OSCE)

· Offensive Security Wireless Professional (OSWP)

· Offensive Security Web Expert (OSWE)

· Certified Ethical Hacker (CEH)

· EC-Council Certified Security Analyst (ECSA)

· Certified Ethical Hacker (CEH) Practical

· EC-Council Certified Security Analyst (ECSA) Practical

· Licensed Penetration Tester (LPT) Master

· Certified Incident Handler (GCIH)

· Penetration Tester (GPEN)

· Web Application Penetration Tester (GWAPT)

· Exploit Researcher and Advanced Penetration Tester (GXPN)

· Assessing and Auditing Wireless Networks (GAWN)

Penetration Testing - Blue Teaming Two or more of the following certifications are required.

· Certified Network Defender (CND)

· Certified Network Defense Architect (CNDA)

· Certified Incident Handler (GCIH)

· Certified Intrusion Analyst (GCIA)

· Defending Advances Threats (GDAT)

· Defensible Security Architecture (GDSA)

· Certified Enterprise Defender (GCED)

Additional Clarification

· Relevant experience is experience directly reflecting the work, task or project being evaluated. The nature of the activities, analyses and work products must be very similar or identical to those of the intended project.

· The Government may request specialized expertise not listed in the labor category description to fulfill a particular cybersecurity testing requirement. The specialized expertise must fall within the scope of the contract or must be relevant to the work activities described in Sections C.3 and C.4.

· Certification is official recognition of professional level expertise. Certification is official recognition by a trade association, industry organization, an industry or trade governance organization, an educational institution, a government agency or department, or a large corporation with a market dominant product. Certification denotes an advanced level of specific expertise commensurate with advanced educational degrees. Certification may result from work experience, education, training or a combination of these.

· All Associates, Bachelors, or graduate degrees must be from an accredited university or college.