Cyber Security Operation Center Lead NF5

Bachelors’ Degree in Information Technology or Business related field appropriate to the work of position AND five years of experience performing specific tasks for digital information and/or incident handling: OR an appropriate combination of education and experience that demonstrates possession of knowledge and skill equivalent to that gained in the above, OR appropriate experience that demonstrates the applicant has acquired the knowledge, skills, and abilities equivalent to that gained in the above. 

Knowledge of specific operational impacts of cyber security lapses, cyber threats and vulnerabilities. Understand business continuity and disaster recovery continuity of operations plans. Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy. Understanding of risk management processes, secure configuration management techniques, encryption algorithms, host/network access control mechanisms, vulnerability information dissemination sources, Payment Card Industry (PCI) data security standards, Personally Identifiable Information (PII) data security standards, incident categories, incident responses, timelines for responses, intrusion detection methodologies and techniques for detecting host and network-based intrusions.

Skill in preserving evidence integrity according to standard operating procedures or national standards, protecting a network against malware, using security event correlation tools, performing damage assessments, design incident response for cloud service models, identifying, capturing, containing, and reporting malware, running Security Content Automation Protocol (SCAP) content and Security Technical Implementation Guides (STIGS) based tools for benchmark and security configuration reviews.

Ability to identify systemic security issues based on the analysis of signatures and indicators from use cases, design incident response for cloud service models, apply cybersecurity and privacy principles to organizational requirements, conduct audit log analysis, and translate results into evaluative conclusions.

As an authorized and privileged user of Department of Defense Information Systems must fulfill the requirement to complete DoD Workforce Improvement Program certification (DoD 8570.01-M) as a condition of access within six months of employment. This position has been determined as a cyber security incident responder with level 3 IAT.

This position had been determined as Moderate Risk.  As a condition of employment, the incumbent must be able to obtain and maintain an Access National Agency Check and Inquiries (ANACI/ Tier 3) Secret Clearance to access classified information.

Eligible for incremental telework as determined by MR/MF policy.