IT Cybersecurity Specialist, ATEC HQ G6

POSITION DUTIES:

Serves as Information Technology (IT) Specialist Policy Planning/Information Security in the G-6 Directorate, U.S. Army Test and Evaluation Command (ATEC) supporting the Program Information Systems Security Manager (P-ISSM). Performs as a key team member of the Division formulating, interpreting, disseminating, and enforcing cybersecurity policies and procedures. Executes selected tasks and functions within the cybersecurity mission area. Maintains a specialized knowledge and familiarization with all aspects of cybersecurity (e.g. network security, endpoint security, configuration management, incident response, contingency planning, security assessments, etc.).

Serves as an ISSM with organization-wide authority to protect all Information Technology (IT) assets, systems, networks, data and information. Formulates Cybersecurity policy, guidance, and establishes appropriate organization-wide Cybersecurity management structure and Cybersecurity business processes, procedures and practices. Sets Cybersecurity goals and objectives, writes the Systems Security Plans to meet public law, Office of Management and Budget (OMB), Department of Defense (DoD) and Army information security requirements, and evaluates the effectiveness of IT policy and security measures. Oversees and manages the Risk Management Framework (RMF) for organization-wide systems (business & combat/weapon). Implements the organization’s vulnerability management program and reports compliance to Headquarters Department of the Army (HQDA). Prepares and briefs Cybersecurity status/security conditions to the organization Chief Information Officer (CIO) and other senior managers as necessary.

MAJOR DUTIES:

1. Establishes and manages portions of the organization Cybersecurity Program. Will for the command. Promulgates Cybersecurity policy and guidance throughout the organization. Responsible for . Establishes procedures within the command to document status of business information system and weapons/combat information system accreditation. Ensures that DoD and Army Cybersecurity training requirements are met. Responsible for determining, formulating, and writing policy, guidelines and procedures to oversee the Cybersecurity Assessment and Vulnerability Program and ensure it is implemented and effective in all associated commands/locations. Responsible for writing and interpreting regulations to establish and manage Cybersecurity incident reporting and compliance, to include procedures for vulnerability management. Ensures that Cybersecurity standards are enforced. Responsible for interpreting regulations and writing alert procedures to notify Cybersecurity personnel, system and network administrators, and command operations personnel of incidents that affect Computer Network Defense (CND). Ensures that the Cyberspace Protection Condition (CPCON) program is implemented and executed in accordance with Joint Chiefs of Staff (JCS) and Army policy. Assesses Cybersecurity posture and provides management reports. Has authority to commit organization to specific courses of action to ensure the integrity of information assurance and protect systems and networks against denial of service and interruption. Responsibilities also may include: assessment and authorization of systems and networks; vulnerability management, to include scanning and analysis of results; incident response; information technology contingency planning / disaster recovery planning; POA&M completion and analysis; and ensuring compliance with Security Technical Implementation Guides; reviews and advises P-ISSM on correctness and completeness of inter-organization agreements, such as MOAs, MOUs, and ISAs; and identification and protection of Mission Relevant Terrain – Cyberspace.

2. Administers and monitors implementation of the Risk Management Framework (RMF). Provides advice and guidance to the P-ISSM pertinent to compliance with the Assess and Authorize (A&A) process throughout all stages of system acquisition, development, and maintenance. Reviews Assess and Authorize (A&A) documentation to ensure that it is compliant with RMF standards. Reviews risk assessments and analyze impact of potential vulnerabilities. Independently develops procedures to generate and maintain required documentation to include the System Security Plan, the RMF Package documents, and Plan of Action and Milestones (POA&M). Independently develops guidance and assists subordinates through the Categorize, Selection, Implementation, Assessment, Authorization and Monitoring phases. Works closely with the NETCOM Security Controls Assessor Army and other ATEC ISSMs to ensure timely certification testing of systems being accredited, identification of system security shortcomings residual risks, and coordinate with the system certification team to resolve issues and mitigate residual risk. Keeps ATEC Authorizing Official (AO) and P-ISSM briefed on systems accreditation status and provide necessary coordination to acquire the Approval to Operate (ATO) for systems. Takes any other steps that may be necessary to ensure timely accreditation, review and reaccreditation of weapons/combat systems developed under the appropriate authority. Maintains database of system accreditation status, develops reports, and alerts system proponents when accreditation documentation must be updated.

3. Conducts assessments for Cybersecurity as part of the Organization Inspection Program and as a member of the Security Control Assessor – Organization (SCA-O) team to determine compliance with applicable regulations and policies, security controls, and reviews and evaluates the security impact of system changes. Participates in meetings and workgroups addressing Cybersecurity issues. Coordinates with Cybersecurity managers, to include DoD, HQDA, and other Army Commands and subordinate commands to discuss and resolve Cybersecurity issues and requirements. Actively participates in influencing and determining policies to resolve Cybersecurity issues and requirements. This will require the incumbent to determine, formulate, and effectively make policy. Represents the command position on Cybersecurity issues in decision meetings with the HQDA G6/Chief Information Officer (CIO) staff and other Army Commands involved in Cybersecurity oversight and management.

4. Maintains a cognizance of Army Cybersecurity policy and develops organization policy and procedures that implement initiatives to include Remote Access, Cybersecurity Tools, Web Cache, Network DMZ, Connection Approval Process, and Defense Research and Engineering Network (DREN)/NIPRNET/SIPRNET security. Sets and establishes the different requirements to develop and implement information systems security technology and procedures, to include Public Key Infrastructure (PKI) and multi-factor authentication technologies that address access control and authentication of users and transmitted information. Determines what the specifications and standards should be for any procured Cybersecurity software, hardware, or services and decides or directs the procurements of Cybersecurity software, hardware or services needed to protect organization systems and networks. Coordinates with subordinates, Director(s) of Network Enterprise Center (NEC's), HQDA, DREN and Defense Information Systems Agency (DISA) Point of Contact to ensure that Connection Approval Process requirements are met where applicable and submitted in accordance with DoD and Army policy.

5. Represents ATEC at meetings and working groups to present the command’s position and posture. Conducts or chairs meetings and seminars to collaborate and exchange related IM, IT, and Cybersecurity policies, procedures, and standards. Coordinates final agreements on matters within the incumbent's subject matter expertise.

6. Independently set priorities, plans work, and presents completed work to supervisor. Provides advice to peers on both administrative and technical matters within their scope. Identifies developmental training requirements annually; and plans schedule accordingly. Establishes and monitors internal controls, as necessary to safeguard government resources from fraud, waste, abuse, or misappropriation. Researches and composes a wide-range of informational memorandums, administrative and technical correspondence, for supervisor’s signature and distribution.
Performs other duties as assigned.