* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of the Security Assessment and Authorization process.

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of Risk Management Framework (RMF) requirements.

Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

Knowledge of new and emerging information technology (IT) and cybersecurity technologies.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of structured analysis principles and methods.

Knowledge of confidentiality, integrity, and availability principles.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Establish acceptable limits for the software application, network, or system.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of embedded systems.

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of policy-based and risk adaptive access controls.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of systems diagnostic tools and fault identification techniques.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Knowledge of countermeasures for identified security risks.

Skill in designing security controls based on cybersecurity principles and tenets.

Knowledge of secure acquisitions (e.g., relevant Contracting Officer’s Technical Representative [COTR] duties, secure procurement, supply chain risk management).

Evaluate cost benefit, economic, and risk analysis in decision making process.

Manage authorization packages.

Authorizing Official only: Approve authorization packages.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Knowledge of threat and risk assessment.

Authorizing Official only: Determine if the security and privacy risk from operating a system or using a system, service, or application from an external provider is acceptable.

Knowledge of the organization’s core business/mission processes.

Knowledge of emerging security issues, risks, and vulnerabilities.

Knowledge of organization’s risk tolerance and/or risk management approach.

Knowledge of supply chain risk management standards, processes, and practices.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of information technology (IT) risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.

Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity and AI.

Knowledge of organization objectives, leadership priorities, and decision-making risks.

Authorizing Official only: Approve security and privacy assessment plans for systems and environments of operation.

Respond to threats and vulnerabilities based on the results of ongoing/continuous monitoring activities and risk assessments and decide if risk remains acceptable.

Review and approve security categorization results for systems.

Review security and privacy assessment plans for systems and environments of operation.

Knowledge of methods and techniques for analyzing risk.

Knowledge of types of authorizations.

Determine the authorization boundaries of systems.

Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of risk assessments and authorization per Risk Management Framework processes.

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Develop methods to monitor and measure risk, compliance, and assurance efforts.

Develop specifications to ensure risk, compliance, and assurance efforts conform with security, resilience, and dependability requirements at the software application, system, and network environment level.

Draft statements of preliminary or residual security risks for system operation.

Maintain information systems assurance and accreditation materials.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of embedded systems.

Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).

Knowledge of new and emerging control systems technologies.

Knowledge of new and emerging information technology (IT) and cybersecurity technologies.

Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

Knowledge of structured analysis principles and methods.

Knowledge of systems diagnostic tools and fault identification techniques.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Skill in applying confidentiality, integrity, and availability principles.

Skill in identifying measures or indicators of system performance and the actions needed to improve or correct performance, relative to the goals of the system.

Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).

Perform validation steps, comparing actual results with expected results and analyze the differences to identify impact and risks.

Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks.

Provide an accurate technical evaluation of the software application, system, or network, documenting the security posture, capabilities, and vulnerabilities against relevant cybersecurity compliances.

Recommend new or revised security, resilience, and dependability measures based on the results of reviews.

Review and approve security and privacy assessment plans.

Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network.

Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations.

Verify that the software application/network/system accreditation and assurance documentation is current.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Knowledge of the organization’s core business/mission processes.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Skill in evaluating the trustworthiness of the supplier and/or product.

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of an organization’s information classification program and procedures for information compromise.

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.