RFR #146_MD78SeniorSystemsSecuritySpecialistRFR012926.docx

Request for Resume (RFR)

IT CONSULTING AND TECHNICAL SERVICES IDIQ

All Master Contract Provisions Apply MD78SeniorSystemsSecuritySpecialistRFR012926

Section 1 – General Information

Labor Category/s

Enter the labor category/s to be provided:

Systems Security Specialist (Senior)

Duration of Assignment

The period of performance for the base period of the Task Order Agreement will be assigned in the Task Order award (anticipated from March 2, 2026, through June 30, 2026). MHBE will have the unilateral option to renew the term of the Task Order Agreement for two additional one-year terms from July 1, 2026, through and including June 30, 2028 (option periods delineated in RFRs may vary).

Issue Date:

mm/dd/yyyy

mm/dd/yyyy 02/11/2026

Time (EST):

00:00 am/pm 10:00 a.m.

The candidate may be required to work on-site or remotely on specific days as determined by MHBE.

Special Instructions:

(e.g. interview information, attachments, etc.)

1. MHBE reserves the right to make awards for hiring up to two (2) resources.

2. Each Master Contractor may submit resumes for a maximum of one (1) candidate for consideration.

3. Attachment 1 must be signed and dated by the Master Contractor and each proposed candidate. Attachment 2 must be signed and dated by the Master Contractor.

4. The Procurement Officer shall, for each round of interviews, determine whether phone/internet or in-person interviews will be utilized.

5. MHBE reserves the right to require the Master Contractor selected for award under this RFR to submit a signed commitment letter from the proposed candidate prior to execution of the Task Order Agreement by MHBE. Where a resource the Master Contractor has proposed is no longer available, MHBE reserves the right to cancel a Notice of Award. See RFP §2.6.4 Substitution of Personnel.

Security Requirements (if applicable):

Refer to IT Consulting and Technical Support Services IDIQ #BPM031490, RFP Section 3.2.3 Security Clearance/Criminal Background Checks, and RFP Attachment G – Non-Exchange Entity Agreement referencing privacy and security requirements related to Personally Identifiable Information. [footnoteRef:1] [1: MHBE reserves the right to modify these instructions to require Master Contractors to complete a Business Associate Agreement where applicable. MHBE also reserves the right to require additional security requirements where it is contemplated that the awarded resource will have access to Federal Tax Information (FTI). ]

It is imperative that the prices included on the Price Proposal Form have been entered correctly and calculated accurately by the Master Contractor and that the respective total prices agree with the entries on the Price Proposal Form. Any incorrect entries or inaccurate calculations by the Master Contractor will be treated as provided in COMAR 21.05.03.03E and 21.05.02.12, and may cause the proposal to be rejected.

Special Invoicing Instructions:

In addition to the invoicing requirements in Section 3.4, Invoicing of IT Consulting and Technical Support Service IDIQ RFP #BPM031490, MHBE supervisor-approved timesheets for each contracted resource must be submitted with each invoice.

Section 2 – MHBE Procurement Officer (PO) Information

Section 3 – Scope of Work

MHBE / Project Background

The Maryland Health Benefit Exchange (MHBE), an independent unit of state government, provides accessible, affordable health coverage to Marylanders. MHBE administers Maryland Health Connection (MHC), the state’s health insurance marketplace. Through MHC, Maryland residents explore health insurance plans, compare rates, and determine their eligibility for advanced premium tax credits (APTC), cost-sharing reductions (CSR), and public assistance programs such as Medicaid and the Maryland Children’s Health Insurance Program (MCHP).

MHBE seeks two (2) Senior Systems Security Specialists to plan, design, develop, administer, monitor, and govern various security policies, controls, and systems for the Health Benefit Exchange (HBX) and other systems.

Job Description

Labor Category/s (From Section 1 Above) Duties / Responsibilities

Perform security assessments, working closely with DevOps and Developer teams on identifying security and privacy issues in AWS or Azure and finding solutions to provide required functionality securely.

Continuously monitor the Health Benefit Exchange (HBX) and ancillary systems, not limited to cloud security operations, responding to security issues and escalating as necessary.

Conduct security impact analysis of controls on proposed system changes.

Conduct cloud security assessments and Penetration testing.

Perform Incident Response and Forensics evaluation using security information and event management (SIEM) tools.

Ensure that the MHBE system security requirements are addressed during all phases of the system development life cycle.

Review and update systems security documentation and artifacts such as Systems Security Plan, Information Security Risk Assessment, Privacy Impact Assessment, Systems Security Report, Correction Action Plan, Plan of Action & Milestones (POA&M).

Create and track POA&M requirements for resolving security findings.

Administer cloud-based and physical firewalls.

Deploy and administer Identity and Access Management products in various operating systems.

Perform monitoring and operations of Identity and Access Management implementation.

Design enhancements in Identity and Access Management products ForgeRock and SailPoint.

Maintain, monitor, and provide operational support for IAM products, computer programs, systems, and other security technologies and revise system design and quality standards.

Make changes to IAM and underline applications for enhancing enterprise security and ensure safe and secure operation to enable access to our systems for our employees, contractors, consumers, and stakeholders.

Perform Security Incident Response and Forensics evaluation using security information and event management (SIEM) tools.

Provide operational support for other security technologies.

Perform account/access management with IAM and other security tools.

Adhere to all security, change control, and MHBE Project Management Office (PMO) policies, processes, and methodologies.

Note: The candidate must be flexible to work overtime as needed, including weekends, holidays, and off-hours.

2.6 Personnel Qualifications - Minimum Qualifications

For minimum qualifications, see the labor category description in MHBE IT IDIQ RFP for the subject RFR labor category. In addition, qualified candidates MUST meet the minimum qualifications specified below. Please refer to RFP Section 2.6.1 minimum qualifications for substitution requirements.

Candidates not meeting minimum qualifications will be deemed not reasonably susceptible for the award and will not progress to full evaluation.

Labor Category/s (From Section 1 Above) Minimum Qualifications

A minimum of five (5) years performing day-to-day security operations functions, including administration, troubleshooting, and resolution of various security components.

A minimum of four (4) years of hands-on experience in performing cloud security functions.

A minimum of four (4) years of experience in defining computer security requirements for high-level applications and evaluating approved security product capabilities.

A minimum of four (4) years of demonstrated production experience using AWS Cloud supporting security operations.

A minimum of four (4) years of experience with administering security for Windows and Linux operating systems.

Experience in performing Security Incident Response and Forensics evaluation with SIEM tools.

Working knowledge of AWS security features such as Security Groups, Network Access Control List, Firewall, WAF, Guard Duty, Macie, CloudTrail, CloudWatch, Control Tower, etc.

Experience with assessment and evaluation of information systems to recommend changes and mitigate threats, risks, and vulnerabilities.

Demonstrated ability to perform scheduled maintenance activities such as patching, performance tuning, and backups.

Demonstrated ability to perform user provisioning and de-provisioning activities.

Experience in monitoring the security infrastructure for operational effectiveness.

Preferred Qualifications The additional Experience/Knowledge/Skills listed below are preferred by MHBE.

A minimum of five (5) years of specialized experience in defining computer security requirements for high-level applications, evaluating approved security product capabilities, and developing solutions to multilevel security problems.

A minimum of five (5) years of hands-on experience providing operational support for ForgeRock and Sailpoint IAM products.

A minimum of five (5) years of experience with the assessment and evaluation of information systems to recommend changes and mitigate threats, risks, and vulnerabilities.

A minimum of five (5) years of experience conducting Incident Response testing to evaluate processes for detection, response, and reporting of security incidents.

A minimum of three (3) years of hands-on experience designing, developing, deploying, and administering security policies for health insurance marketplaces or complex health and human services systems.

Experience configuring ForgeRock to enable single sign-on with different applications and implementing password sync across all internal applications.

Experience with configuration and administration of SailPoint and performing tasks such as designing an organizational tree structure and creating provisioning and de-provisioning policies.

Experience implementing ID policies, password policies, access control lists (ACL), reconciliation, service definition, the configuration of remote resources, workflows, password synchronization, reconciliation schedules, and life cycle management.

Experience in providing detailed configuration and administration for programs such as ACL configuration, Group Management, and configuration management.

Hands-on experience with troubleshooting, investigating operational problems, and providing workarounds, resolutions, and remediations.

Experience developing IT Security roadmaps and execution plans.

Demonstrated technical knowledge of command line utilities running on various platforms, including Linux and MS Windows.

Experience with implementation of integration solutions between IAM system and user account repositories such as Active Directory, LDAP, and Databases.

Experience with Java, JavaScript, and shell scripts.

Experience assisting organizations meeting NIST SP 800-37, NIST 800-53, IRS Publication 1075, and MARS-e 2.0 requirements.

Experience with conducting vulnerability management and penetration testing efforts.

Experience in configuring and reviewing ASA and/or Fortinet firewalls.

Possess one or more security certifications such as CISSP, ISO, CSA STAR Cloud Security Advisor, CCSE, QCS, CNA, VCP, or equivalent.

Experience working with the Project Management Office (PMO) processes, policies, and procedures.

Substitution of Proposed Personnel

SUBSTITUTION OF PERSONNEL BEFORE AWARD

The substitution of Proposed Personnel during the evaluation period, prior to award, is prohibited. A substitution of any kind, post TO Proposal due date, but prior to award, is considered to be the equivalent of an alternate proposal and is prohibited.

SUBSTITUTION OF PERSONNEL AFTER AWARD

Contractor Personnel may be substituted after award in accordance with the following procedures in RFP Section 2.5.6 Substitution of Personnel: A) The Contractor may not substitute Contractor Personnel without the prior approval of the Contract Monitor, B) To replace any Contractor Personnel, the Contractor shall submit resumes of the proposed individual specifying the intended approved labor category. Any proposed substitute personnel shall have relevant qualifications equal to or better than those of the replaced personnel. C) The Contract Monitor shall have the option to interview the proposed substitute individual and shall notify the Contractor of acceptance or denial of the requested substitution.

Section 4 - Required Submissions

1. Master Contractors may propose a maximum of one (1) candidate for the position requested.

2. Please note that an individual candidate may only be submitted by one Master Contractor. If more than one Master Contractor submits an individual candidate, MHBE may deem the submission non-responsive and no longer eligible to be considered for award.

3. Master Contractors proposing in response to the RFR must submit the documents below as separate files contained in two separate emails as follows:

Email 1 of 2 with “Technical and PIA”: Master Contractor Name, RFR number, and candidate name(s) in the subject line

1. Resume for each proposed candidate (Attachment 1).

2. Three (3) current references that can be contacted for performance verification of the submitted candidate’s work experience and skill, including telephone number and email address (Attachment 1).

3. Proof of Certifications, if applicable.

4. A PIA-ready copy of its RFR response, including Attachments 1 and 2 for Public Information Act (PIA) requests (this copy shall be redacted so that confidential and/or proprietary information has been removed (see RFP Section 4.12 “Public Information Act Notice”).

Email 2 of 2 with “Financial”: Master Contractor Name, RFR number, and candidate name(s) in the subject line

1. Price Proposal for each proposed candidate (Attachment 2).

Section 5 – Evaluation Criteria Proposed candidates meeting the Minimum Qualifications listed in Section 3 above will be evaluated for the overall best value, with technical factors carrying more weight than financial factors, as follows:

1. Work experience

2. Training and education

3. Presentation and responses to questions at the interview

4. Price

Basis for Award Recommendation MHBE PO will recommend award(s) to the Master Contractor(s) whose proposal(s) are determined to be the most advantageous to the State, considering the price and the evaluation factors set forth in the RFR. MHBE PO will initiate and deliver a Task Order Agreement to the selected Master Contractor. Master Contractors should be aware that if selected, State law regarding conflict of interest may prevent future participation in procurements related to the RFR Scope of Work, depending upon specific circumstances.

ATTACHMENT 1

RFR RESUME FORM – Systems Security Specialist (Senior) MD78SeniorSystemsSecuritySpecialistRFR012826 Instructions: Enter resume information in the fields below; do not submit other resume formats. Submit only one resume per the Labor Category described in Section 1 of the RFR.

Candidate Legal Name:

Master Contractor:

Are any relatives or family members working at MHBE (Yes/No)?

If yes, who and what is the relationship?

A. Education / Training

<add lines as needed>

B. Relevant Work Experience Describe work experience relevant to the Duties / Responsibilities and Minimum Experience / Knowledge / Skill described in Section 3 of the RFR. Start with the most recent experience first; do not include non-relevant experience.

[Organization] [Title / Role] [Period of Employment / Work] [Location] [Contact Person (Optional if current employer)]

Description of Work…

[Organization] [Title / Role] [Period of Employment / Work] [Location] [Contact Person]

Description of Work…

<add lines as needed>

C. Employment History List employment history, starting with the most recent employment first

<add lines as needed>

D. References List persons the State may contact as employment references

<add lines as needed>

LABOR CATEGORY PERSONNEL RESUME SUMMARY

(ATTACHMENT 1 CONTINUED)

*“Candidate Relevant Education” and “Candidate Relevant Experience” sections must be filled out. Do not enter “see resume” as a response.

Proposed Individual’s Name/Company:

How does the proposed individual meet each requirement?

LABOR CATEGORY TITLE – Systems Security Specialist (Senior)

Education Bachelor’s degree from an accredited college or university in Engineering, Computer Science, Information Systems, Business, or other related disciplines.

A minimum of eight (8) years of experience analyzing, defining, deploying, monitoring, and administering security requirements and controls for large and mission-critical IT systems.

A minimum of five (5) years performing day-to-day security operations functions, including administration, troubleshooting, and resolution of various security components.

A minimum of four (4) years of hands-on experience in performing cloud security functions.

A minimum of four (4) years of experience in defining computer security requirements for high-level applications and evaluating approved security product capabilities.

A minimum of four (4) years of demonstrated production experience using AWS Cloud supporting security operations.

A minimum of four (4) years of experience with administering security for Windows and Linux operating systems.

Experience in performing Security Incident Response and Forensics evaluation with SIEM tools.

Working knowledge of AWS security features such as Security Groups, Network Access Control List, Firewall, WAF, Guard Duty, Macie, CloudTrail, CloudWatch, Control Tower, etc.

Experience with assessment and evaluation of information systems to recommend changes and mitigate threats, risks, and vulnerabilities.

Demonstrated ability to perform scheduled maintenance activities such as patching, performance tuning, and backups.

Demonstrated ability to perform user provisioning and de-provisioning activities.

Experience in monitoring the security infrastructure for operational effectiveness.

A minimum of five (5) years of experience implementing, administering, and monitoring Security Controls and Governance for public-facing complex IT systems.

A minimum of five (5) years of specialized experience in defining computer security requirements for high-level applications, evaluating approved security product capabilities, and developing solutions to multilevel security problems.

A minimum of five (5) years of hands-on experience providing operational support for ForgeRock and Sailpoint IAM products.

A minimum of five (5) years of experience with the assessment and evaluation of information systems to recommend changes and mitigate threats, risks, and vulnerabilities.

A minimum of five (5) years of experience conducting Incident Response testing to evaluate processes for detection, response, and reporting of security incidents.

A minimum of three (3) years of hands-on experience designing, developing, deploying, and administering security policies for health insurance marketplaces or complex health and human services systems.

Experience configuring ForgeRock to enable single sign-on with different applications and implementing password sync across all internal applications.

Experience with configuration and administration of SailPoint and performing tasks such as designing an organizational tree structure and creating provisioning and de-provisioning policies.

Experience implementing ID policies, password policies, access control lists (ACL), reconciliation, service definition, the configuration of remote resources, workflows, password synchronization, reconciliation schedules, and life cycle management.

Experience in providing detailed configuration and administration for programs such as ACL configuration, Group Management, and configuration management.

Hands-on experience with troubleshooting, investigating operational problems, and providing workarounds, resolutions, and remediations.

Experience developing IT Security roadmaps and execution plans.

Demonstrated technical knowledge of command line utilities running on various platforms, including Linux and MS Windows.

Experience with implementation of integration solutions between IAM system and user account repositories such as Active Directory, LDAP, and Databases.

Experience with Java, JavaScript, and shell scripts.

Experience assisting organizations meeting NIST SP 800-37, NIST 800-53, IRS Publication 1075, and MARS-e 2.0 requirements.

Experience with conducting vulnerability management and penetration testing efforts.

Experience in configuring and reviewing ASA and/or Fortinet firewalls.

Possess one or more security certifications such as CISSP, ISO, CSA STAR Cloud Security Advisor, CCSE, QCS, CNA, VCP, or equivalent.

Experience working with the Project Management Office (PMO) processes, policies, and procedures.

The information provided on this form for this labor category is true and correct to the best of my knowledge:

Master Contractor Representative:

Print Name Signature Date

Proposed Candidate:

Print Name Signature Date

Instruction: Sign each form.

ATTACHMENT 2

PRICE PROPOSAL – Systems Security Specialist (Senior) MD78SeniorSystemsSecuritySpecialistRFR012826 (This form is to be filled out by Master Contractors - Submit with the Financial Response)

Fully Loaded Hourly Labor Rate Evaluation Hours Extended Price (A x C)

Base Year 3 (March 2, 2026-June 30, 2026)

Option Year 1 (July 1, 2026-June 30, 2027)

Option Year 2 (July 1, 2027-June 30, 2028)

Total Evaluated Price

Authorized Individual Name

Company Name

Title

Company Tax ID #

Signature

Date

The Hourly Labor Rate cannot exceed the Master Contract rate but may be lower. Price Proposals that include proposed hourly rates higher than those proposed in the Master Contract Rate shall be deemed nonresponsive and will not be considered for award. Proposed rates must be fully loaded, all-inclusive, and shall include all direct and indirect costs for the Master Contractor to perform under the TOA. Evaluation Hours are for evaluation purposes only and do not represent actual hours to be worked or invoiced.