Ensure compliance to governing documents and security policies and assist in regulatory periodic assessments. Implements and tests state-of-the-art secure operating systems, networks, and database solutions. Stays current with system vulnerabilities and provides current security training to all system users. Conducts risk assessments and provides recommendations for secure implementation and compliance in accordance with government regulations and information assurance/cybersecurity guidelines. Creates, maintains and submits information system security documents and reports to regulatory agencies. Assesses and mitigates system security threats/risks throughout the program life cycle; validates system security requirements definition and analysis; establishes system security documentation; assists with the implementation of security procedures; verifies information system security requirements; performs information system certification and accreditation planning, testing, assessing and liaison activities. Familiar with information system security architectural documentation standards. Able to apply information assurance / cyber security standards, directives, guidance and policies to an architectural/risk based framework. Provide architectural / risk based analysis of information assurance / cyber security features and relate existing system to future needs and trends and requirements. For engineers providing security information assurance, use Info Assurance Engineer (E254, L254). For security professionals providing systems security analysis, use Computer Systems Security Analysis (E121, L121).
• Oversee day-to-day information system security operations including auditing the IS, hardware, and software implementations and RMF package authorizations.
• Carry out technical administration of IS in accordance with internal LM and customer security requirements, primarily Risk Management Framework (RMF).
• Upkeep, monitor, analyze, and respond to network and security events.
• Document compliance actions with the ISSM to address non-compliance in the allotted time frame.
• Ensure systems are operated, maintained, and disposed of in accordance with internal security policies and practices.
• Participate in internal/external security audits/inspections; performs risk assessments.
• Ensure records are maintained for workstations, software, servers, routers, firewalls, network switches, telephony equipment, etc. throughout the information system's life cycle.
• Evaluate proposed changes or additions to the information system, and advise the ISSM of their security relevance.
• Ensure configuration management (CM) for security relevant IS software, hardware, and firmware is maintained and documented.
• Assist in conducting investigations of computer security violations and incidents, reporting as necessary.
• Ensure proper protection and / or corrective measures have been taken when an incident or vulnerability has been discovered.
• Communicate, implement and manage a formal Information Security / Information Systems Security Program together with ISSM and CPSO.
