Meet the O&M and availability needs for all technical implementations to include security policy enforcement, auditing (resource protection), monitoring, patch and vulnerability management, user awareness, and incident response.
Focus on the engineering and management of technical assessment and vulnerability analysis capabilities with direct hands on with penetration testing, system exploitation and cyber security engineering.
Implementation of policies, standards, procedures, and guidelines to ensure compliance of system security architectures with Enterprise-level security architecture standards. Conduct comprehensive assessment of management, operational and technical security controls employed by the information system to determine the overall effectiveness of controls. Specifically, are the implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
Concentration in the areas of Certification and Accreditation (C&A)/ (A&A), Security Governance and Policy (ICD 503), Contractual Agreements and Procurement Processes, Risk Management Concepts and Security Education, Training and Awareness. Provide Body of Evidence (e.g. Systems Security Plan) defining the security boundary, diagramming all facets of the process flow and interfaces, articulating the authentication and authorization methods, describing the implementation of the access control, audit strategy and continuous monitoring methods.
Develop applications with strictly security controls regarding authorization and access control following established Systems Development Life Cycle (SDLC), security testing (functional testing) and reviewing code, defining security features, and threat modeling.
Closely integrated with the rest of the team on security accreditation for the application. In charge of writing unit tests and works directly with the project’s team functional tester to ensure application quality. Understand and proficient with the following key technology areas: Object-Oriented analysis and design, relational database design and development using either AJAX, DHTML, CSS, PHP, JavaScript, HTML, XML, Ruby on Rails, Hadoop, Java or C++ programming, graphical user interface design and development, analytical modeling or visualization, Agular, or Bootstrap. Additionally, demonstrate knowledge with Subversion or Git ideal or similar development tools.
The methods of securing information to ensure its integrity, confidentiality, and authenticity. Specifically, have a working understanding of Public Key Infrastructure (PKI), Digital Signatures, and Encryption Concepts.
Knowledgeable with information security practices to include cryptography, privilege separation, RBAC, Auditing, Security Benchmark Compliance, and OS hardening).
The principals of network structures, transmission methods and transport formats. Specifically, posses a working knowledge of Network Architecture and Design, Network attacks prevention, Communication channels, Vulnerabilities and threats.
Expertise with network Infrastructure components from Cisco, Juniper, Vyatta, Vyos, and AWS. Proficiency with planning, designing and implementing Cisco Routers, Switches, Wireless Networking, VPNs, Firewalls, and Network Security. Provide guidance and recommendations for technical standards, security standards, and Operational Assurance. Working knowledge of network Packet Capture Analysis tools, such as Wireshark. Additionally, understand proactive monitoring concepts, including experience configuring and deploying Network and systems monitoring, SNMP, Relational Databases (i.e. Ganglia, Nagios, Zenoss, Splunk, SolarWinds, or NoSQL and Caching Layers such as Memcache etc.). Experience with the OSI stack and how to troubleshoot a problem at each layer of the stack. Identify with core communication protocols such as TCP/IP, UDP, SSL, HTTP/S and building application-specific protocols on top of them.
Maintain level of acceptable risk and compliance management methodologies. Proficient with understanding information security regulations including assisting in research, evaluation and development of relevant security policies and guidance. Specifically, perform data analysis on assessment findings to determine trends, and develop reports on those trends in an effort to increase security awareness.
Covers all aspects of InfoSec Assessment (reviewing Body of Evidence) with emphasis on penetration testing (scans), quality assurance reviews, code reviews, determining risk and provide guidance to project teams. Specifically, propose security direction regarding developing, hardening and migration of vulnerabilities of IT systems. Provide Quality assurance reviews on security evaluation test plan and procedures. Assist with the implementation, modification, and improvement of the client’s implementation of the Risk Management Framework (RMF) workflow and its component parts.
