* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of the Security Assessment and Authorization process.

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of Risk Management Framework (RMF) requirements.

Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

Knowledge of new and emerging information technology (IT) and cybersecurity technologies.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of structured analysis principles and methods.

Knowledge of confidentiality, integrity, and availability principles.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Establish acceptable limits for the software application, network, or system.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of embedded systems.

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of policy-based and risk adaptive access controls.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of systems diagnostic tools and fault identification techniques.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Knowledge of countermeasures for identified security risks.

Skill in designing security controls based on cybersecurity principles and tenets.

Knowledge of secure acquisitions (e.g., relevant Contracting Officer’s Technical Representative [COTR] duties, secure procurement, supply chain risk management).

Evaluate cost benefit, economic, and risk analysis in decision making process.

Manage authorization packages.

Authorizing Official only: Approve authorization packages.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Provide enterprise cybersecurity and supply chain risk management guidance.

Authorizing Official only: Determine if the security and privacy risk from operating a system or using a system, service, or application from an external provider is acceptable.

Knowledge of the organization’s core business/mission processes.

Knowledge of emerging security issues, risks, and vulnerabilities.

Knowledge of organization’s risk tolerance and/or risk management approach.

Knowledge of supply chain risk management standards, processes, and practices.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of information technology (IT) risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.

Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity and AI.

Knowledge of organization objectives, leadership priorities, and decision-making risks.

Authorizing Official only: Approve security and privacy assessment plans for systems and environments of operation.

Respond to threats and vulnerabilities based on the results of ongoing/continuous monitoring activities and risk assessments and decide if risk remains acceptable.

Review and approve security categorization results for systems.

Review security and privacy assessment plans for systems and environments of operation.

Knowledge of methods and techniques for analyzing risk.

Knowledge of types of authorizations.

Determine the authorization boundaries of systems.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of disaster recovery continuity of operations plans.

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of incident response and handling methodologies.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Advise senior management (e.g., CIO) on risk levels and security posture.

Ensure security improvement actions are evaluated, validated, and implemented as required.

Recognize a possible security violation and take appropriate action to report the incident, as required.

Supervise or manage protective or corrective measures when an cybersecurity incident or vulnerability is discovered.

Knowledge of an organization’s information classification program and procedures for information compromise.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

Knowledge of system life cycle management principles, including software security and usability.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Knowledge of information security program management and project management principles and techniques.

Knowledge of secure acquisitions (e.g., relevant Contracting Officer’s Technical Representative [COTR] duties, secure procurement, supply chain risk management).

Advise senior management (e.g., CIO) on cost/benefit analysis of information security programs, policies, processes, and systems, and elements.

Communicate the value of information technology (IT) security throughout all levels of the organization stakeholders.

Collaborate with stakeholders to establish the enterprise continuity of operations program, strategy, and mission assurance.

Establish overall enterprise information security architecture (EISA) with the organization’s overall security strategy.

Evaluate cost benefit, economic, and risk analysis in decision making process.

Knowledge of critical information technology (IT) procurement requirements.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).

Knowledge of remote access technology concepts.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Mitigate/correct security deficiencies identified during security/certification testing and/or recommend risk acceptance for the appropriate senior leader or authorized representative.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Knowledge of general SCADA system components.

Skill in determining installed patches on various operating systems and identifying patch signatures.

Apply updates, patches, and security technical implementation while maintaining control system performance and availability requirements.

Establish and maintain security configuration baseline for the control system(s), including field devices, IT components, interconnections, and interfaces.

Implement Risk Management Framework (RMF) Assessment requirements for control systems, and document/maintain records for them.

Maintain knowledge of the function and security of control system and IT technologies with which the control systems interface.

Maintain network segmentation to isolate control systems from business networks and other external connections as directed.

Perform asset management and maintain inventory of control system devices and components through physical inspection or logical scans.

Support risk assessments by reviewing and documenting the implementation status of security requirements of control systems.

Knowledge of control system technologies, such as Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) software, Distributed Control Systems (DCS) and Operational Technology (OT).

* Knowledge of specific operational impacts of cybersecurity lapses.

Knowledge of control system environment risks, threats and vulnerabilities.

Knowledge of risk management processes specific to control systems.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in applying security and managing risk in resource-constrained systems and networks.

Skill in architecting compensating security controls to reduce risk for control systems and control system components that do not have adequate or compliant security capabilities.

Skill in securing control system communication protocols (e.g., IP/TCP, SSL/TLS, MODBUS/DNP3/PROFINET SCADA, GOOSE) and media used for field device control.

Skill in recognizing vulnerabilities in security systems.

Knowledge of embedded systems.

Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).

Knowledge of current and emerging cyber technologies.

Knowledge of operating system command line/prompt.

Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

Knowledge of the Risk Management Framework Assessment Methodology.

Act as a liaison between facility operations/engineer teams and IT or network security teams to coordinate security activities.

Apply tailored organizational security policies and procedures for control system environments to maintain security, but also to ensure system availability.

Consult on control system security matters (e.g., risk assessment, configuration management) as needed.

Ensure configuration and collection of control system audit logs for monitoring and forensic analysis as appropriate.

Off-load and review control system audit logs and review for anomalies.

Participate in control system change management in conjunction with IT personnel and control system experts (e.g., system supplier).

Participate in control system incident and disaster response, including secure system recovery.

Knowledge of control system performance and availability requirements.

Knowledge of RMF assessment types (e.g., Assess & Authorize (A&A), Assess Only) and authorization boundaries (e.g., Closed Restricted Network (CRN), Stand-alone Information System (SIS)).

Knowledge of what “normal” control system operations for specific mission/business functions look like.

Skill in active and passive methods to safely gather information and conduct vulnerability and network analysis scans in control system environments.

Skill in identifying and investigating “abnormal” control system operations based on what specific mission/business functions look like.

Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.

Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of network traffic analysis methods.

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.

Skill in performing packet-level analysis.

Skill in collecting data from a variety of cyber defense resources.

Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.

Coordinate with enterprise-wide cyber defense staff to validate network alerts.

Document and escalate incidents (including event’s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.

Perform cyber defense trend analysis and reporting.

Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.

Perform security reviews and identify security gaps in security architecture resulting in recommendations for the inclusion into the risk mitigation strategy.

Provide daily summary reports of network events and activity relevant to cyber defense practices.

Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.

Skill in recognizing and categorizing types of vulnerabilities and associated attacks.

Knowledge of how to use network analysis tools to identify vulnerabilities.

Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.

Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.

Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.

Knowledge of cyber defense policies, procedures, and regulations.

Knowledge of the common attack vectors on the network layer.

Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).

Knowledge of general kill chain (e.g., footprinting and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).

Identify and analyze anomalies in network traffic using metadata (e.g., CENTAUR).

Conduct research, analysis, and correlation across a wide variety of all source data sets (indications and warnings).

Identify applications and operating systems of a network device based on network traffic.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in recognizing vulnerabilities in information and/or data systems.

Knowledge of authentication, authorization, and access control methods.

Knowledge of computer algorithms.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of database systems.

Knowledge of embedded systems.

Knowledge of host/network access control mechanisms (e.g., access control list).

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of incident response and handling methodologies.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Skill in conducting trend analysis.

Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).

Knowledge of current and emerging cyber technologies.

Knowledge of operating systems.

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of policy-based and risk adaptive access controls.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of key concepts in security management (e.g., Release Management, Patch Management).

Knowledge of security system design tools, methods, and techniques.

Knowledge of systems security testing and evaluation methods.

Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).

Knowledge of the cyber defense Service Provider reporting structure and processes within one’s own organization.

Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.

Knowledge of Virtual Private Network (VPN) security.

Skill in developing and deploying signatures.

Knowledge of countermeasures for identified security risks.

Skill in assessing security controls based on cybersecurity principles and tenets.

Skill in detecting host and network based intrusions via intrusion detection technologies.

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Skill in evaluating the adequacy of security designs.

Knowledge of network mapping and recreating network topologies.

Skill in using incident handling methodologies.

Skill in using protocol analyzers.

Knowledge of the use of sub-netting tools.

Knowledge of common adversary tactics, techniques, and procedures in assigned area of responsibility (i.e., historical country-specific tactics, techniques, and procedures; emerging capabilities).

Knowledge of common network tools (e.g., ping, traceroute, nslookup).

Knowledge of defense-in-depth principles and network security architecture.

Knowledge of different types of network communication (e.g., LAN, WAN, MAN, WLAN, WWAN).

Knowledge of file extensions (e.g., .dll, .bat, .zip, .pcap, .gzip).

Knowledge of operating system command line/prompt.

Develop content for cyber defense tools.

Analyze and report system security posture trends.

Analyze and report organizational security posture trends.

Ensure cybersecurity-enabled products or other compensating security control technologies reduce identified risk to an acceptable level.

Assess adequate access controls based on principles of least privilege and need-to-know.

Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber defense threat condition and determine which security issues may have an impact on the enterprise.

Assess and monitor cybersecurity related to system implementation and testing practices.

Plan and recommend modifications or adjustments based on exercise results or system environment.

Provides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.

Work with stakeholders to resolve computer security incidents and vulnerability compliance.

Knowledge of interpreted and compiled computer languages.

Knowledge of collection management processes, capabilities, and limitations.

Knowledge of front-end collection systems, including traffic collection, filtering, and selection.

Skill in using network analysis tools, including specialized tools for non-traditional systems and networks (e.g., control systems), to identify vulnerabilities.​

Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.

Knowledge of threat environments (e.g., first generation threat actors, threat activities).

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

Determine tactics, techniques, and procedures (TTPs) for intrusion sets.

Examine network topologies to understand data flows through the network.

Recommend computing environment vulnerability corrections.

Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.

Isolate and remove malware.

Identify applications and operating systems of a network device based on network traffic.

Reconstruct a malicious attack or activity based off network traffic.

Identify network mapping and operating system (OS) fingerprinting activities.

Knowledge of encryption methodologies.

Skill in reading and interpreting signatures (e.g., snort).

Knowledge of signature implementation impact.

Ability to interpret and incorporate data from multiple tool sources.

Knowledge of Windows/Unix ports and services.

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the NE or enclave.

Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event’s history, status, and potential impact for further action in accordance with the organization’s cyber incident response plan.

Ability to analyze malware.

Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).

Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.

Knowledge of cloud service models and possible limitations for an incident response.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of basic concepts and practices of processing digital forensic data.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Skill in preserving evidence integrity according to standard operating procedures or national standards.

Knowledge of investigative implications of hardware, Operating Systems, and network technologies.

Skill in analyzing memory dumps to extract information.

Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, FTK).

Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.

Conduct analysis of log files, evidence, and other information in order to determine best methods for identifying the perpetrator(s) of a network intrusion.

Confirm what is known about an intrusion and discover new information, if possible, after identifying intrusion via dynamic analysis.

Provide technical summary of findings in accordance with established reporting procedures.

Examine recovered data for information of relevance to the issue at hand.

Perform file signature analysis.

Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).

Perform file system forensic analysis.

Knowledge of data carving tools and techniques (e.g., Foremost).

Skill in deep analysis of captured malicious code (e.g., malware forensics).

Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump).

Knowledge of reverse engineering concepts.

Knowledge of anti-forensics tactics, techniques, and procedures.

Knowledge of malware analysis tools (e.g., Oily Debug, Ida Pro).

Skill in analyzing anomalous code as malicious or benign.

Skill in analyzing volatile data.

Skill in identifying obfuscation techniques.

Skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Knowledge of binary analysis.

Skill in analyzing malware.

Skill in conducting bit-level analysis.

Skill in processing digital evidence, to include protecting and making legally sound copies of evidence.

Ability to conduct forensic analyses in and for both Windows and Unix/Linux environments.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of incident response and handling methodologies.

Knowledge of operating systems.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of server and client operating systems.

Knowledge of server diagnostic tools and fault identification techniques.

Knowledge of the common networking protocols (e.g., TCP/IP), services (e.g., web, mail, Domain Name Server), and how they interact to provide network communications.

Skill in developing, testing, and implementing network infrastructure contingency and recovery plans.

Skill in performing packet-level analysis.

Knowledge of basic physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).

Knowledge of file system implementations (e.g., New Technology File System [NTFS], File Allocation Table [FAT], File Extension [EXT]).

Knowledge of processes for seizing and preserving digital evidence (e.g., chain of custody).

Knowledge of hacking methodologies in Windows or Unix/Linux environment.

Knowledge of legal governance related to admissibility (e.g., Federal Rules of Evidence).

Knowledge of processes for collecting, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.

Knowledge of types and collection of persistent data.

Knowledge of web mail collection, searching/analyzing techniques, tools, and cookies.

Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.

Skill in identifying and extracting data of forensic interest in diverse media (i.e., media forensics).

Skill in identifying, modifying, and manipulating applicable system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).

Skill in collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.

Skill in setting up a forensic workstation.

Skill in using virtual machines.

Skill in physically disassembling PCs.

Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is not unintentionally modified, to use for data recovery and analysis processes. This includes, but is not limited to, hard drives, floppy diskettes, CD, PDA, mobile phones, GPS, and all tape formats.

Decrypt seized data using technical means.

Ensure chain of custody is followed for all digital media acquired in accordance with the Federal Rules of Evidence.

Identify digital evidence for examination and analysis in such a way as to avoid unintentional alteration.

Perform dynamic analysis to boot an “image” of a drive (without necessarily having the original drive) to see the intrusion as the user may have seen it, in a native environment.

Perform hash comparison against established database.

Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView).

Perform timeline analysis.

Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).

Perform static media analysis.

Perform tier 1, 2, and 3 malware analysis.

Prepare digital media for imaging by ensuring data integrity (e.g., write blockers in accordance with standard operating procedures).

Provide technical assistance on digital evidence matters to appropriate personnel.

Recognize and accurately report forensic artifacts indicative of a particular operating system.

Review forensic images and other data sources (e.g., volatile data) for recovery of potentially relevant information.

Use data carving techniques (e.g., FTK-Foremost) to extract data for further analysis.

Capture and analyze network traffic associated with malicious activities using network monitoring tools.

Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.

Write and publish cyber defense recommendations, reports, and white papers on incident findings to appropriate constituencies.

Knowledge of types of digital forensics data and how to recognize them.

Knowledge of deployable forensics.

Ability to decrypt digital data collections.

Knowledge of security event correlation tools.

Conduct cursory binary analysis.

Knowledge of legal rules of evidence and court procedure.

Serve as technical expert and liaison to law enforcement personnel and explain incident details as required.

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Perform virus scanning on digital media.

Perform static analysis to mount an “image” of a drive (without necessarily having the original drive).

Perform static malware analysis.

Utilize deployable forensics tool kit to support operations as necessary.

Skill in one way hash functions (e.g., Secure Hash Algorithm [SHA], Message Digest Algorithm [MD5]).

Knowledge of common forensics tool configuration and support applications (e.g., VMWare, WIRESHARK).

Knowledge of debugging procedures and tools.

Knowledge of how different file types can be used for anomalous behavior.

Knowledge of virtual machine aware malware, debugger aware malware, and packing.

Coordinate with intelligence analysts to correlate threat assessment data.

Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.

Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.

Process image with appropriate tools depending on analyst’s goals.

Perform Windows registry analysis.

Perform file and registry monitoring on the running system after identifying intrusion via dynamic analysis.

Enter media information into tracking database (e.g. Product Tracker Tool) for digital media that has been acquired.

Correlate incident data and perform cyber defense reporting.

Maintain deployable cyber defense toolkit (e.g. specialized cyber defense software/hardware) to support IRT mission.

Knowledge of cloud service models and possible limitations for an incident response.

Knowledge of network architecture concepts including topology, protocols, and components.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of disaster recovery continuity of operations plans.

Knowledge of how network services and protocols interact to provide network communications.

Knowledge of incident categories, incident responses, and timelines for responses.

Knowledge of incident response and handling methodologies.

Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.

Skill of identifying, capturing, containing, and reporting malware.

Skill in preserving evidence integrity according to standard operating procedures or national standards.

Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.

Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus) to maintain currency of cyber defense threat condition and determine which security issues may have an impact on the enterprise.

Coordinate incident response functions.

Perform cyber defense trend analysis and reporting.

Perform initial, forensically sound collection of images and inspect to discern possible mitigation/remediation on enterprise systems.

Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.

Write and publish cyber defense techniques, guidance, and reports on incident findings to appropriate constituencies.

Skill in securing network communications.

Skill in recognizing and categorizing types of vulnerabilities and associated attacks.

Skill in protecting a network against malware.

Skill in performing damage assessments.

Skill in using security event correlation tools.

Knowledge of cyber defense policies, procedures, and regulations.

Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).

Knowledge of malware analysis concepts and methodologies.

Collect intrusion artifacts (e.g., source code, malware, trojans) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, covering tracks).

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).

Write and publish after action reviews.

Knowledge of cloud service models and possible limitations for an incident response.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of host/network access control mechanisms (e.g., access control list).

Knowledge of network traffic analysis methods.

Knowledge of packet-level analysis.

Correlate incident data to identify specific vulnerabilities and make recommendations that enable expeditious remediation.

Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible threats to network security.

Perform cyber defense incident triage, to include determining scope, urgency, and potential impact; identifying the specific vulnerability; and making recommendations that enable expeditious remediation.

Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).

Track and document cyber defense incidents from initial detection through final resolution.

Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple places, layered defenses, security robustness).

Knowledge of threat environments (e.g., first generation threat actors, threat activities).

Serve as technical expert and liaison to law enforcement personnel and explain incident details as required.

Knowledge of an organization’s information classification program and procedures for information compromise.

Coordinate with intelligence analysts to correlate threat assessment data.

Knowledge of key factors of the operational environment and related threats and vulnerabilities.

Knowledge of the common networking and routing protocols(e.g. TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications.

Knowledge of cloud service models and possible limitations for an incident response.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of host/network access control mechanisms (e.g., access control list).

Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.

Knowledge of incident response and handling methodologies.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of network traffic analysis (tools, methodologies, processes).

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol (TCP), Internet Protocol (IP), Open System Interconnection Model (OSI)).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of Virtual Private Network (VPN) security.

Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.

Identify potential conflicts with implementation of any cyber defense tools(e.g., tool and signature testing and optimization).

Assist in identifying, prioritizing, and coordinating the protection of critical cyber defense infrastructure and key resources.

Knowledge of cyber defense policies, procedures, and regulations.

Knowledge of test procedures, principles, and methodologies (e.g., Capabilities and Maturity Model Integration (CMMI)).

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Build, install, configure, and test dedicated cyber defense hardware.

Assist in assessing the impact of implementing and sustaining a dedicated cyber defense infrastructure.

Skill in troubleshooting and diagnosing cyber defense infrastructure anomalies and work through resolution.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of packet-level analysis.

Skill in applying host/network access controls (e.g., access control list).

Skill in tuning sensors.

Skill in using incident handling methodologies.

Skill in using Virtual Private Network (VPN) devices and encryption.

Coordinate with system administrators to create cyber defense tools, test bed(s), and test and evaluate applications, hardware infrastructure, rules/signatures, access controls, and configurations of platforms managed by service provider(s).

Coordinate with Cyber Defense Analysts to manage and administer the updating of rules and signatures (e.g., intrusion detection/protection systems, anti-virus, and content blacklists) for specialized cyber defense applications.

Create, edit, and manage network access control lists on specialized cyber defense systems (e.g., firewalls and intrusion prevention systems).

Implement risk assessment and authorization requirements per the Risk Management Framework (RMF) process for dedicated cyber defense systems within the enterprise, and document and maintain records for them.

Perform system administration on specialized cyber defense applications and systems (e.g., anti-virus, audit and remediation) or Virtual Private Network (VPN) devices, to include installation, configuration, maintenance, backup and restoration.

Skill in securing network communications.

Skill in protecting a network against malware.

Knowledge of web filtering technologies.

Knowledge of transmission records (e.g., Bluetooth, Radio Frequency Identification (RFID), Infrared Networking (IR), Wireless Fidelity (Wi-Fi). paging, cellular, satellite dishes, Voice over Internet Protocol (VoIP)), and jamming techniques that enable transmission of undesirable information, or prevent installed systems from operating correctly.

Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration.

Knowledge of basic system, network, and OS hardening techniques.

Knowledge of cloud service models and possible limitations for an incident response.

Skill in system, network, and OS hardening techniques.

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.

Ability to determine the best cloud deployment model for the appropriate operating environment.

Skill in designing or implementing cloud computing deployment models.

Skill in migrating workloads to, from, and among the different cloud computing service models.

Knowledge of access authentication methods.

Knowledge of computer algorithms.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of cryptology.

Knowledge of database systems.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of embedded systems.

Knowledge of fault tolerance.

Knowledge of how system components are installed, integrated, and optimized.

Knowledge of human-computer interaction principles.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of information security systems engineering principles.

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of local area and wide area networking principles and concepts including bandwidth management.

Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of network design processes, to include understanding of security objectives, operational objectives, and tradeoffs.

Knowledge of operating systems.

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of parallel and distributed computing concepts.

Knowledge of policy-based and risk adaptive access controls.

Knowledge of process engineering concepts.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of secure configuration management techniques.

Knowledge of security management.

Knowledge of software development models (e.g., Waterfall Model, Spiral Model).

Knowledge of software engineering.

Knowledge of structured analysis principles and methods.

Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.

Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.

Knowledge of system life cycle management principles, including software security and usability.

Knowledge of systems testing and evaluation methods.

Knowledge of the systems engineering process.

Skill in designing countermeasures to identified security risks.

Skill in designing security controls based on cybersecurity principles and tenets.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Skill in evaluating the adequacy of security designs.

Analyze design constraints, analyze trade-offs and detailed system and security design, and consider lifecycle support.

Apply security policies to applications that interface with one another, such as Business-to-Business (B2B) applications.

Assess the effectiveness of cybersecurity measures utilized by system(s).

Assess threats to and vulnerabilities of computer system(s) to develop a security risk profile.

Build, test, and modify product prototypes using working models or theoretical models.

Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).

Design and develop cybersecurity or cybersecurity-enabled products.

Design, develop, integrate, and update system security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.

Design or integrate appropriate data backup capabilities into overall system designs, and ensure appropriate technical and procedural processes exist for secure system backups and protected storage of backup data.

Design to security requirements to ensure requirements are met for all systems and/or applications.

Develop and direct system testing and validation procedures and documentation.

Develop detailed security design documentation for component and interface specifications to support system design and development.

Develop Disaster Recovery and Continuity of Operations plans for systems under development and ensure testing prior to systems entering a production environment.

Identify and direct the remediation of technical problems encountered during testing and implementation of new systems (e.g., identify and find work-arounds for communication protocols that are not interoperable).

Implement security designs for new or existing system(s).

Incorporate cybersecurity vulnerability solutions into system designs (e.g., Cybersecurity Vulnerability Alerts).

Perform an information security risk assessment.

Perform security reviews and identify security gaps in architecture.

Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.

Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

Store, retrieve, and manipulate data for analysis of system capabilities and requirements.

Provide support to security/certification test and evaluation activities.

Design and develop key management functions (as related to cybersecurity).

Analyze user needs and requirements to plan and conduct system security development.

Ensure security design and cybersecurity development activities are properly documented (providing a functional description of security implementation) and updated as necessary.

Skill in conducting audits or reviews of technical systems.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

Knowledge of service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Implement and integrate system development life cycle (SDLC) methodologies (e.g., IBM Rational Unified Process) into development environment.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Employ configuration management processes.

Design, implement, test, and evaluate secure interfaces between information systems, physical systems, and/or embedded technologies.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of electrical engineering as applied to computer architecture, including circuit boards, processors, chips, and associated computer hardware.

Knowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).

Knowledge of mathematics, including logarithms, trigonometry, linear algebra, calculus, and statistics.

Knowledge of microprocessors.

Knowledge of Privacy Impact Assessments.

Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).

Skill in integrating and applying policies that meet system security objectives.

Knowledge of countermeasure design for identified security risks.

Skill in designing the integration of hardware and software solutions.

Skill in developing and applying security system access controls.

Skill in the use of design modeling (e.g., unified modeling language).

Develop risk mitigation strategies and cybersecurity countermeasures to address cost, performance, and security risks and to resolve vulnerabilities and recommend security changes to system or system components as needed.

Develop mitigation strategies to address cost, schedule, performance, and security risks.

Identify components or elements, allocate security functions to those elements, and describe the relationships between the elements.

Identify and prioritize essential system functions or sub-systems required to support essential capabilities or business functions for restoration or recovery after a system failure or during a system recovery event based on overall system requirements for continuity and availability.

Identify, assess, and recommend cybersecurity or cybersecurity-enabled products for use within a system and ensure recommended products are in compliance with organization’s evaluation and validation requirements.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Provide guidelines for implementing developed systems to customers or installation teams.

Provide input to implementation plans and standard operating procedures as they relate to information systems security.

Trace system requirements to design components and perform gap analysis.

Utilize models and simulations to analyze or predict system performance under different operating conditions.

Verify stability, interoperability, portability, and/or scalability of system architecture.

Knowledge of interpreted and compiled computer languages.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Develop cybersecurity designs to meet specific operational needs and environmental factors (e.g., access controls, automated applications, networked operations, high integrity and availability requirements, multilevel security/processing of multiple classification levels, and processing Sensitive Compartmented Information).

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration.

Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).

Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).

Knowledge of an organization’s information classification program and procedures for information compromise.

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.

Ability to determine the best cloud deployment model for the appropriate operating environment.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of disaster recovery continuity of operations plans.

Knowledge of host/network access control mechanisms (e.g., access control list).

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of incident response and handling methodologies.

Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.

Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of server administration and systems engineering theories, concepts, and methods.

Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.

Knowledge of system life cycle management principles, including software security and usability.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.

Skill in creating policies that reflect system security objectives.

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Knowledge of information security program management and project management principles and techniques.

Acquire and manage the necessary resources, including leadership support, financial resources, and key security personnel, to support information technology (IT) security goals and objectives and reduce overall organizational risk.

Advise senior management (e.g., CIO) on risk levels and security posture.

Advise appropriate senior leadership or Authorizing Official of changes affecting the organization’s cybersecurity posture.

Collect and maintain data needed to meet system cybersecurity reporting.

Communicate the value of information technology (IT) security throughout all levels of the organization stakeholders.

Ensure security improvement actions are evaluated, validated, and implemented as required.

Ensure that cybersecurity inspections, tests, and reviews are coordinated for the network environment.

Ensure that cybersecurity requirements are integrated into the continuity planning for that system and/or organization(s).

Identify alternative information security strategies to address organizational security objective.

Identify information technology (IT) security program implications of new technologies or technology upgrades.

Interpret patterns of non compliance to determine their impact on levels of risk and/or overall effectiveness of the enterprise’s cybersecurity program.

Manage the monitoring of information security data sources to maintain organizational situational awareness.

Oversee the information security training and awareness program.

Participate in the development or modification of the computer environment cybersecurity program plans and requirements.

Prepare, distribute, and maintain plans, instructions, guidance, and standard operating procedures concerning the security of network system(s) operations.

Provide system related input on cybersecurity requirements to be included in statements of work and other appropriate procurement documents.

Recognize a possible security violation and take appropriate action to report the incident, as required.

Recommend resource allocations required to securely operate and maintain an organization’s cybersecurity requirements.

Supervise or manage protective or corrective measures when an cybersecurity incident or vulnerability is discovered.

Track audit findings and recommendations to ensure appropriate mitigation actions are taken.

Promote awareness of security issues among management and ensure sound security principles are reflected in the organization’s vision and goals.

Oversee policy standards and implementation strategies to ensure procedures and guidelines comply with cybersecurity policies.

Identify security requirements specific to an information technology (IT) system in all phases of the System Life Cycle.

Ensure plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.

Assure successful implementation and functionality of security requirements and appropriate information technology (IT) policies and procedures that are consistent with the organization’s mission and goals.

Knowledge of organization’s risk tolerance and/or risk management approach.

Knowledge of enterprise incident response program, roles, and responsibilities.

Knowledge of current and emerging threats/threat vectors.

Support necessary compliance activities (e.g., ensure system security configuration guidelines are followed, compliance monitoring occurs).

Continuously validate the organization against policies/guidelines/procedures/regulations/laws to ensure compliance.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of an organization’s information classification program and procedures for information compromise.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of applicable business processes and operations of customer organizations.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of industry-standard and organizationally accepted analysis principles and methods.

Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).

Knowledge of measures or indicators of system performance and availability.

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of network traffic analysis methods.

Knowledge of current and emerging cyber technologies.

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

Knowledge of resource management principles and techniques.

Knowledge of server and client operating systems.

Knowledge of technology integration processes.

Knowledge of secure acquisitions (e.g., relevant Contracting Officer’s Technical Representative [COTR] duties, secure procurement, supply chain risk management).

Acquire necessary resources, including financial resources, to conduct an effective enterprise continuity of operations program.

Advise senior management (e.g., CIO) on cost/benefit analysis of information security programs, policies, processes, and systems, and elements.

Collaborate with stakeholders to establish the enterprise continuity of operations program, strategy, and mission assurance.

Ensure application of security patches for commercial products integrated into system design meet the timelines dictated by the management authority for the intended operational environment.

Ensure that protection and detection capabilities are acquired or developed using the IS security engineering approach and are consistent with organization-level cybersecurity architecture.

Establish overall enterprise information security architecture (EISA) with the organization’s overall security strategy.

Evaluate and approve development efforts to ensure that baseline security safeguards controls/measures are appropriately installed.​

Evaluate cost benefit, economic, and risk analysis in decision making process.

Interface with external organizations (e.g., public affairs, law enforcement, Command or Component Inspector General) to ensure appropriate and accurate dissemination of incident and other Computer Network Defense information.

Interpret and/or approve security requirements relative to the capabilities of new information technologies.

Lead and align information technology (IT) security priorities with the security strategy.

Lead and oversee information security budget, staffing, and contracting.

Manage the publishing of Computer Network Defense guidance (e.g., TCNOs, Concept of Operations, Net Analyst Reports, NTSM, MTOs) for the enterprise constituency.

Manage threat or target analysis of cyber defense information and production of threat information within the enterprise.

Monitor and evaluate the effectiveness of the enterprise’s cybersecurity safeguards to ensure they provide the intended level of protection.

Participate in risk assessment and authorization per Risk Management Framework processes.

Provide enterprise cybersecurity and supply chain risk management guidance for development of the Continuity of Operations Plans.

Provide leadership and direction to information technology (IT) personnel by ensuring that cybersecurity awareness, basics, literacy, and training are provided to operations personnel commensurate with their responsibilities.

Provide technical documents, incident reports, findings from computer examinations, summaries, and other situational awareness information to higher headquarters.

Recommend policy and coordinate review and approval.

Use federal and organization-specific published documents to manage operations of their computing environment system(s).

Participate in Risk Governance process to provide security risks, mitigations, and input on other technical risk.

Evaluate the effectiveness of procurement function in addressing information security requirements and supply chain risks through procurement activities and recommend improvements.

Knowledge of critical information technology (IT) procurement requirements.

Participate in the acquisition process as necessary, following appropriate supply chain risk management practices.

Ensure all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals.

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Forecast ongoing service demands and ensure security assumptions are reviewed as necessary.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Skill in evaluating the trustworthiness of the supplier and/or product.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

Define and/or implement policies and procedures to ensure protection of critical infrastructure as appropriate.

Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of cybersecurity principles and methods that apply to software development.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of operating systems.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of secure configuration management techniques.

Skill in designing countermeasures to identified security risks.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Capture security controls used during the requirements phase to integrate security within the process, to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.

Consult with engineering staff to evaluate interface between hardware and software.

Develop secure software testing and validation procedures.

Identify basic common coding flaws at a high level.

Identify security issues around steady state operation and management of software and incorporate security measures that must be taken when a product reaches its end of life.

Perform secure program testing, review, and/or assessment to identify potential flaws in codes and mitigate vulnerabilities.

Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.

Address security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, common criteria, and methods of independent testing.

Translate security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Determine and document software patches or the extent of releases that would leave software vulnerable.

Skill in using code analysis tools.

Knowledge of software quality assurance process.

Skill in secure test plan design (e. g. unit, integration, system, acceptance).

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of information technology (IT) risk management policies, requirements, and procedures.

Knowledge of secure software deployment methodologies, tools, and practices.

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of complex data structures.

Knowledge of computer programming principles such as object-oriented design.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of embedded systems.

Knowledge of local area and wide area networking principles and concepts including bandwidth management.

Knowledge of low-level computer languages (e.g., assembly languages).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of penetration testing principles, tools, and techniques.

Knowledge of Privacy Impact Assessments.

Knowledge of programming language structures and logic.

Knowledge of software debugging principles.

Knowledge of software design tools, methods, and techniques.

Knowledge of software development models (e.g., Waterfall Model, Spiral Model).

Knowledge of software engineering.

Knowledge of structured analysis principles and methods.

Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.

Knowledge of web services, including service-oriented architecture, Simple Object Access Protocol, and web service description language.

Skill in conducting software debugging.

Skill in developing and applying security system access controls.

Analyze and provide information to stakeholders that will support the development of security a application or modification of an existing security application.

Analyze security needs and software requirements to determine feasibility of design within time and cost constraints and security mandates.

Apply secure code documentation.

Conduct trial runs of programs and software applications to ensure the desired information is produced and instructions and security levels are correct.

Develop threat model based on customer interviews and requirements.

Develop system testing and validation procedures, programming, and documentation.

Evaluate factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration.

Identify security implications and apply methodologies within centralized and decentralized environments across the enterprises computer systems in software development.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Perform integrated quality assurance testing for security functionality and resiliency attack.

Store, retrieve, and manipulate data for analysis of system capabilities and requirements.

Knowledge of interpreted and compiled computer languages.

Knowledge of secure coding techniques.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Knowledge of software related information technology (IT) security principles and methods (e.g., modularization, layering, abstraction, data hiding, simplicity/minimization).

Perform penetration testing as required for new or updated applications.

Skill in integrating black box security testing tools into quality assurance process of software releases.

Knowledge of root cause analysis techniques.

Knowledge of supply chain risk management standards, processes, and practices.

Skill in performing root cause analysis.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).

Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).

Consult with customers about software system design and maintenance.

Direct software programming and development of documentation.

Supervise and assign work to programmers, designers, technologists and technicians and other engineering and scientific personnel.

Ability to use and understand complex mathematical concepts (e.g., discrete math).

Knowledge of mobile device (Android/iOS) development structures, principles, platforms, containers, languages, and the specific vulnerabilities associated with mobile device development.

Skill in implementing defensive programming techniques.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Ability to design architectures and frameworks.

Skill in applying cybersecurity methods, such as firewalls, demilitarized zones, and encryption.

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of integrating the organization’s goals and objectives into the architecture.

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Skill in translating operational requirements into protection needs (i.e., security controls).

Develop/integrate cybersecurity designs for systems and networks with multilevel security requirements or requirements for the processing of multiple classification levels of data primarily applicable to government organizations (e.g., UNCLASSIFIED, SECRET, and TOP SECRET).

Document and address organization’s information security, cybersecurity architecture, and systems security engineering requirements throughout the acquisition lifecycle.

Employ secure configuration management processes.

Ensure acquired or developed system(s) and architecture(s) are consistent with organization’s cybersecurity architecture guidelines.

Identify and prioritize critical business functions in collaboration with organizational stakeholders.

Document the protection needs (i.e., security controls) for the information system(s) and network(s) and document appropriately.

Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.

Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment.

Ability to apply network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

Develop a system security context, a preliminary system security CONOPS, and define baseline system security requirements in accordance with applicable cybersecurity requirements.

Evaluate security architectures and designs to determine the adequacy of security design and architecture proposed or provided in response to requirements contained in acquisition documents.

Knowledge of cybersecurity-enabled software products.

Ability to apply an organization’s goals and objectives to develop and maintain architecture.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Knowledge of authentication, authorization, and access control methods.

Knowledge of computer algorithms.

Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of database systems.

Knowledge of organization’s evaluation and validation criteria.

Knowledge of electrical engineering as applied to computer architecture, including circuit boards, processors, chips, and associated computer hardware.

Knowledge of embedded systems.

Knowledge of system fault tolerance methodologies.

Knowledge of how system components are installed, integrated, and optimized.

Knowledge of human-computer interaction principles.

Knowledge of security risk assessments and authorization per Risk Management Framework processes.

Knowledge of the Security Assessment and Authorization process.

Knowledge of industry-standard and organizationally accepted analysis principles and methods.

Knowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).

Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).

Knowledge of mathematics, including logarithms, trigonometry, linear algebra, calculus, and statistics.

Knowledge of microprocessors.

Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of network design processes, to include understanding of security objectives, operational objectives, and tradeoffs.

Knowledge of operating systems.

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of parallel and distributed computing concepts.

Knowledge of configuration management techniques.

Knowledge of key concepts in security management (e.g., Release Management, Patch Management).

Ability to apply secure system design tools, methods and techniques.

Knowledge of N-tiered typologies including server and client operating systems.

Knowledge of software engineering.

Ability to apply system design tools, methods, and techniques, including automated systems analysis and design tools.

Knowledge of systems testing and evaluation methods.

Knowledge of technology integration processes.

Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).

Knowledge of the enterprise information technology (IT) architectural concepts and patterns to include baseline and target architectures.

Knowledge of the systems engineering process.

Skill in applying and incorporating information technologies into proposed solutions.

Skill in designing the integration of hardware and software solutions.

Skill in design modeling and building use cases (e.g., unified modeling language).

Skill in writing code in a currently supported programming language (e.g., Java, C++).

Analyze user needs and requirements to plan architecture.

Develop threat model based on customer interviews and requirements.

Define and prioritize essential system capabilities or business functions required for partial or full system restoration after a catastrophic failure event.

Define appropriate levels of system availability based on critical system functions and ensure system requirements identify appropriate disaster recovery and continuity of operations requirements to include any appropriate fail-over/alternate site requirements, backup requirements, and material supportability requirements for system recover/restoration.

Develop enterprise architecture or system components required to meet user needs.

Develop procedures and test fail-over for system operations transfer to an alternate site based on system availability requirements.

Document and update as necessary all definition and architecture activities.

Evaluate factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration.

Integrate and align information security and/or cybersecurity policies to ensure system analysis meets security requirements.

Provide advice on project costs, design concepts, or design changes.

Provide input on security requirements to be included in statements of work and other appropriate procurement documents.

Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).

Translate proposed capabilities into technical requirements.

Translate security requirements into application design elements including documenting the elements of the software attack surfaces, conducting threat modeling, and defining any specific security criteria.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Ability to apply the methods, standards, and approaches for describing, analyzing, and documenting an organization’s enterprise information technology (IT) architecture (e.g., Open Group Architecture Framework [TOGAF], Department of Defense Architecture Framework [DoDAF], Federal Enterprise Architecture Framework [FEAF]).

Assess and design security management functions as related to cyberspace.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of program protection planning to include information technology (IT) supply chain security/risk management policies, anti-tampering techniques, and requirements.

Knowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard information technology [IT]) for safety, performance, and reliability.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration.

Knowledge of organizational process improvement concepts and process maturity models (e.g., Capability Maturity Model Integration (CMMI) for Development, CMMI for Services, and CMMI for Acquisitions).

Knowledge of service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).

Knowledge of use cases related to collaboration and content synchronization across platforms (e.g., Mobile, PC, Cloud).

Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).

Knowledge of an organization’s information classification program and procedures for information compromise.

Skill in applying security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Develop data management capabilities (e.g., cloud based, centralized cryptographic key management) to include support to the mobile workforce.

Analyze candidate architectures, allocate security services, and select security mechanisms.

Write detailed functional specifications that document the architecture development process.

Knowledge of circuit analysis.

Knowledge of confidentiality, integrity, and availability requirements.

Knowledge of various types of computer architectures.

Ability to optimize systems to meet enterprise performance requirements.

Knowledge of cloud service models and possible limitations for an incident response.

Knowledge of multi-level/security cross domain solutions.

Skill in designing multi-level security/cross domain solutions.

Skill in the use of design methods.

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.

Ability to determine the best cloud deployment model for the appropriate operating environment.

Skill in designing or implementing cloud computing deployment models.

Skill in migrating workloads to, from, and among the different cloud computing service models.

Knowledge of cyber defense and vulnerability assessment tools, including open source tools, and their capabilities.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of organization’s evaluation and validation requirements.

Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Skill in discerning the protection needs (i.e., security controls) of information systems and networks.

Develop methods to monitor and measure risk, compliance, and assurance efforts.

Develop specifications to ensure risk, compliance, and assurance efforts conform with security, resilience, and dependability requirements at the software application, system, and network environment level.

Draft statements of preliminary or residual security risks for system operation.

Maintain information systems assurance and accreditation materials.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Knowledge of cryptography and cryptographic key management concepts.

Knowledge of organization’s enterprise information security architecture system.

Knowledge of embedded systems.

Knowledge of security risk assessments and authorization per Risk Management Framework processes.

Knowledge of risk management processes and requirements per the Risk Management Framework (RMF).

Knowledge of new and emerging information technology (IT) and cybersecurity technologies.

Knowledge of current and emerging cyber technologies.

Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

Knowledge of structured analysis principles and methods.

Knowledge of systems diagnostic tools and fault identification techniques.

Knowledge of the organization’s enterprise information technology (IT) goals and objectives.

Skill in applying confidentiality, integrity, and availability principles.

Skill in identifying measures or indicators of system performance and the actions needed to improve or correct performance, relative to the goals of the system.

Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).

Perform validation steps, comparing actual results with expected results and analyze the differences to identify impact and risks.

Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks.

Provide an accurate technical evaluation of the software application, system, or network, documenting the security posture, capabilities, and vulnerabilities against relevant cybersecurity compliances.

Recommend new or revised security, resilience, and dependability measures based on the results of reviews.

Review and approve security and privacy assessment plans.

Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network.

Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations.

Verify that the software application/network/system accreditation and assurance documentation is current.

Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).

Knowledge of the organization’s core business/mission processes.

Knowledge of Personally Identifiable Information (PII) data security standards.

Knowledge of Payment Card Industry (PCI) data security standards.

Knowledge of Personal Health Information (PHI) data security standards.

Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.

Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.

Knowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability).

Skill in evaluating the trustworthiness of the supplier and/or product.

Knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zackman, Federal Enterprise Architecture [FEA]).

Knowledge of an organization’s information classification program and procedures for information compromise.

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Develop and Implement cybersecurity independent audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organizational and mandatory cybersecurity requirements and accurately followed by Systems Administrators and other cybersecurity staff when performing their day-to-day activities.

Knowledge of application vulnerabilities.

Skill in conducting application vulnerability assessments.

* Knowledge of computer networking concepts and protocols, and network security methodologies.

Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.

Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.

Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions.

Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.

* Knowledge of cybersecurity principles.

* Knowledge of cyber threats and vulnerabilities.

* Knowledge of specific operational impacts of cybersecurity lapses.

* Knowledge of cloud computing service models Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).

* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.

Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.

Knowledge of cryptography and cryptographic key management concepts.

Skill in assessing the application of cryptographic standards.

Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.

Knowledge of host/network access control mechanisms (e.g., access control list).

Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).

Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.

Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

Ability to apply programming language structures (e.g., source code review) and logic.

Knowledge of programming language structures and logic.

Knowledge of systems diagnostic tools and fault identification techniques.

Skill in assessing the robustness of security systems and designs.

Skill in detecting host and network based intrusions via intrusion detection technologies.

Skill in mimicking threat behaviors.

Knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).

Skill in the use of penetration testing tools and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

Skill in the use of social engineering techniques.

Analyze organization’s cybersecurity policies and configurations and evaluate compliance with regulations and organizational directives.

Conduct and/or support authorized penetration testing on enterprise network assets.

Maintain deployable cybersecurity audit toolkit (e.g., specialized cyber defense software and hardware) to support cybersecurity audit missions.

Knowledge of threat and risk assessment.

Skill in performing impact/risk assessments.

Knowledge of interpreted and compiled computer languages.

Skill in using network analysis tools, including specialized tools for non-traditional systems and networks (e.g., control systems), to identify vulnerabilities.​

Conduct required reviews as appropriate within environment (e.g., Technical Surveillance, Countermeasure Reviews [TSCM], TEMPEST countermeasure reviews).

Perform technical (evaluation of technology) and non-technical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, control system and operational environments, enclave boundary, supporting infrastructure, and applications).

Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).

Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).

Knowledge of threat environments (e.g., first generation threat actors, threat activities).

Knowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored).

Knowledge of basic system administration, network, and operating system hardening techniques.

Knowledge of infrastructure supporting information technology (IT) for safety, performance, and reliability.

Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, covering tracks).

Knowledge of an organization’s information classification program and procedures for information compromise.

Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

Knowledge of ethical hacking principles and techniques.

Knowledge of data backup and restoration concepts.

Knowledge of system administration concepts for Unix/Linux and/or Windows operating systems.

Knowledge of cloud service models and possible limitations for an incident response.

Skill in reviewing logs to identify evidence of past intrusions.

Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.