DUTIES: Applies knowledge of network protocols, architectures, equipment, services, standards and technology to various IT assessments. Capable of designing, configuring, integrating and deploying open source and commercial applications and tools to monitor and assess information technology systems. Uses comprehensive knowledge of federal mandates and NIST guidance to plan and execute Security Testing and Evaluations of applications, systems and networks that is fully compliant with NIST guidance. Has thorough knowledge of all aspects of incident response including identification, mitigation, detection, containment, resolution, and restoration to minimize loss and destruction to information technology systems assets and data. Proficient in incident response policies, standards, and best practices and ability to convey information to technical and non­technical audiences verbally and in writing. Knowledge of all aspects of intrusion detection management, audit management, network and database vulnerability assessment and compliance management, security configuration, and auditing tool management. Proficient in researching and evaluating emerging information technologies relevant to information security; interpreting requirements and providing analytical reviews for system architecture, equipment and software; and providing recommendations. Compile, draft, review, develop, and deliver input on all aspects relevant to information security activities, processes, and associated documentation. Provides support on all issues relative to information security activities at the program level including policy development, compliance inspections, audits, reviews and communications security. Current comprehensive knowledge of security and privacy related regulations, guidance and processes to include, but not limited to FISMA, NIST, OMB.

QUALIFICATIONS: A degree in Computer Science, Information Systems, Engineering, Business, or other related technical discipline is preferred. This position requires eight (8) years of general experience, (6) years of Information Security specialized experience and two (2) years of information technology experience.

EXPERIENCE: General Experience: Includes eight (8) years of experience in the development and/or analysis, interpretation, and compliance with federal and agency IT security policies and regulations at progressively increasing levels of responsibility.

Information Security Specialized Experience: Six (6) years of experience in Information Security. Experience in network monitoring using host-based and network-based intrusion detection systems. Knowledge of computer hardware and operating systems (Windows and UNIX). Knowledge of incident response handling policy and procedures. Knowledge of computer hardware and operating systems. Knowledge of intrusion detection systems and other information security products, regulations, standards, and guidelines.

Information Technology Experience: Two (2) years of experience integrating, developing or deploying security products in enterprise level technology upgrades. Knowledge of information technology security architectures.

EDUCATION SUBSTITUTION: An advanced degree in Computer Science, Information Systems, Engineering, Business, or other related scientific or technical discipline may be considered equivalent to two (2) years generalized and two (2) years information security specialized experience. Certificates such as Microsoft's MCSE, may be considered equivalent to two (2) years of general experience and two (2) years of information technology experience. The CISSP certificate may be considered equivalent to two (2) years of information security experience.