* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of cybersecurity principles and methods that apply to software development.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of operating systems.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of secure configuration management techniques.

Skill in designing countermeasures to identified security risks.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Capture security controls used during the requirements phase to integrate security within the process, to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.

Consult with engineering staff to evaluate interface between hardware and software.

Develop secure software testing and validation procedures.

Identify basic common coding flaws at a high level.

Identify security issues around steady state operation and management of software and incorporate security measures that must be taken when a product reaches its end of life.

Perform secure program testing, review, and/or assessment to identify potential flaws in codes and mitigate vulnerabilities.

Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.

Address security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, common criteria, and methods of independent testing.

Translate security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Determine and document software patches or the extent of releases that would leave software vulnerable.

Skill in using code analysis tools.

Knowledge of software quality assurance process.

Skill in secure test plan design (e. g. unit, integration, system, acceptance).

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of information technology (IT) risk management policies, requirements, and procedures.

Knowledge of secure software deployment methodologies, tools, and practices.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of complex data structures.

Knowledge of computer programming principles such as object-oriented design.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of embedded systems.

Knowledge of local area and wide area networking principles and concepts including bandwidth management.

Knowledge of low-level computer languages (e.g., assembly languages).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of Privacy Impact Assessments.

Knowledge of programming language structures and logic.

Knowledge of software debugging principles.

Knowledge of software design tools, methods, and techniques.

Knowledge of software development models (e.g., Waterfall Model, Spiral Model).

Knowledge of software engineering.

Knowledge of structured analysis principles and methods.

Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.

Knowledge of web services, including service-oriented architecture, Simple Object Access Protocol, and web service description language.

Skill in conducting software debugging.

Skill in developing and applying security system access controls.

Analyze and provide information to stakeholders that will support the development of security a application or modification of an existing security application.

Analyze security needs and software requirements to determine feasibility of design within time and cost constraints and security mandates.

Apply secure code documentation.

Conduct trial runs of programs and software applications to ensure the desired information is produced and instructions and security levels are correct.

Develop threat model based on customer interviews and requirements.

Develop system testing and validation procedures, programming, and documentation.

Evaluate factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration.

Identify security implications and apply methodologies within centralized and decentralized environments across the enterprises computer systems in software development.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Perform integrated quality assurance testing for security functionality and resiliency attack.

Store, retrieve, and manipulate data for analysis of system capabilities and requirements.

Knowledge of interpreted and compiled computer languages.

Knowledge of secure coding techniques.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Knowledge of software related information technology (IT) security principles and methods (e.g., modularization, layering, abstraction, data hiding, simplicity/minimization).

Perform penetration testing as required for new or updated applications.

Skill in integrating black box security testing tools into quality assurance process of software releases.

Knowledge of root cause analysis techniques.

Knowledge of supply chain risk management standards, processes, and practices.

Skill in performing root cause analysis.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).

Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).

Consult with customers about software system design and maintenance.

Direct software programming and development of documentation.

Supervise and assign work to programmers, designers, technologists and technicians and other engineering and scientific personnel.

Ability to use and understand complex mathematical concepts (e.g., discrete math).

Knowledge of mobile device (Android/iOS) development structures, principles, platforms, containers, languages, and the specific vulnerabilities associated with mobile device development.

Skill in implementing defensive programming techniques.

Knowledge of complex data structures.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of computer programming principles such as object-oriented design.

Knowledge of cybersecurity principles and methods that apply to software development.

Knowledge of operating systems.

Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

Knowledge of programming language structures and logic.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of software debugging principles.

Knowledge of software design tools, methods, and techniques.

Knowledge of software development models, methodologies, and practices (Waterfall Model, Spiral, Agile, DevSecOps).

Knowledge of software engineering.

Knowledge of structured analysis principles and methods.

Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.

Knowledge of web services, including service-oriented architecture, Simple Object Access Protocol, and web service description language.

Skill in conducting software debugging.

Skill in creating programs that validate and process multiple inputs including command line arguments, environmental variables, and input streams.

Skill in developing applications that can log and handle errors, exceptions, and application faults and logging.

Knowledge of development and application of security system access controls.

Analyze information to determine, recommend, and plan the development of a new application or modification of an existing application.

Analyze user needs and software requirements to determine feasibility of design within time and cost constraints.

Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Apply secure code documentation.

Capture security controls used during the requirements phase to integrate security within the process, to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.

Compile and write documentation of program development and subsequent revisions, inserting comments in the coded instructions so others can understand the program.

Conduct trial runs of programs and software applications to ensure the desired information is produced and instructions and security levels are correct.

Confer with systems analysts, engineers, programmers, and others to design application and to obtain information on project limitations and capabilities, performance requirements, and interfaces.

Consult with engineering staff to evaluate interface between hardware and software.

Correct errors by making appropriate changes and rechecking the program to ensure desired results are produced.

Design, develop, and modify software systems, using scientific analysis and mathematical models to predict and measure outcome and consequences of design.

Develop software system testing and validation procedures, programming, and documentation.

Develop secure code and error handling.

Identify basic common coding flaws at a high level.

Modify and maintain existing software to correct errors, to adapt it to new hardware, or to upgrade interfaces and improve performance.

Perform secure programming and identify potential flaws in codes to mitigate vulnerabilities.

Prepare detailed workflow charts and diagrams that describe input, output, and logical operation, and convert them into a series of instructions coded in a computer language.

Translate security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Knowledge of interpreted and compiled computer languages.

Skill in applying secure coding techniques.

Knowledge of secure coding techniques.

Knowledge of software related information technology (IT) security principles and methods (e.g., modularization, layering, abstraction, data hiding, simplicity/minimization).

Apply cybersecurity functions (e.g., encryption, access control, and identity management) to reduce exploitation opportunities.

Skill in using code analysis tools.

Ability to develop secure software according to secure software deployment methodologies, tools, and practices.

Identify and leverage the enterprise-wide version control system while designing and developing secure applications.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Direct software programming and development of documentation.

Design, implement, test, and evaluate secure interfaces between information systems, physical systems, and/or embedded technologies.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of embedded systems.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of local area and wide area networking principles and concepts including bandwidth management.

Knowledge of low-level computer languages (e.g., assembly languages).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of Privacy Impact Assessments.

Knowledge of secure configuration management techniques.

Skill in creating and utilizing mathematical or statistical models.

Skill in designing countermeasures to identified security risks.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Develop software system testing and validation procedures, programming, and documentation.

Evaluate factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration.

Identify security implications and apply methodologies within centralized and decentralized environments across the enterprises computer systems in software development.

Identify security issues around steady state operation and management of software and incorporate security measures that must be taken when a product reaches its end of life.

Perform integrated quality assurance testing for security functionality and resiliency attack.

Address security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, common criteria, and methods of independent testing.

Store, retrieve, and manipulate data for analysis of system capabilities and requirements.

Design countermeasures and mitigations against potential exploitations of programming language weaknesses and vulnerabilities in system and elements.

Determine and document software patches or the extent of releases that would leave software vulnerable.

Knowledge of software quality assurance process.

Knowledge of root cause analysis techniques.

Knowledge of supply chain risk management standards, processes, and practices.

Skill in performing root cause analysis.

Skill in secure test plan design (e. g. unit, integration, system, acceptance).

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of information technology (IT) risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).

Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).

Enable applications with public keying by leveraging existing public key infrastructure (PKI) libraries and incorporating certificate management and encryption functionalities when appropriate.

Identify and leverage the enterprise-wide security services while designing and developing secure applications (e.g., Enterprise PKI, Federated Identity server, Enterprise AV solution) when appropriate.

Consult with customers about software system design and maintenance.

Supervise and assign work to programmers, designers, technologists and technicians and other engineering and scientific personnel.

Ability to use and understand complex mathematical concepts (e.g., discrete math).

Skill in managing user relationships, including determining user needs/requirements, managing user expectations, and demonstrating commitment to delivering quality results.

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.

Ability to determine the best cloud deployment model for the appropriate operating environment.

Skill in designing or implementing cloud computing deployment models.

Skill in migrating workloads to, from, and among the different cloud computing service models.

Knowledge of planning for long-term maintainability using architectural structures, viewpoints, styles, design decisions and frameworks, and the underlying data structures.