Plans, coordinates, and implements security measures for information systems to regulate access to computer data files and prevent unauthorized modification, destruction, or disclosure of information. Documents and keeps current all information security rules and policies. Advises and consults on all CIO project-related information security issues, control gates, and the security review processes in place within the . Evaluates emerging and available INFOSEC technologies to enable systems and users to securely share information with customers and the IC. Performs penetration testing and evaluation of network/server configurations to identify potential vulnerabilities. Performs risk analysis of tested and evaluated networks and systems. Integrates security processes and architectures to address CIO, , and IC information security issues and concerns.
Tasks:
- Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs.
- Confer with users to discuss issues such as computer data access needs, security violations, and programming changes.
- Monitor current reports of computer viruses to determine when to update virus protection systems.
- Modify computer security files to incorporate new software, correct errors, or change individual access status.
- Monitor use of data files and regulate access to safeguard information in computer files.
- Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures.
- Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers.
- Document computer security and emergency measures policies, procedures, and tests.
- Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.
- Develop and document integrated security architecture to enable or enhance the CIO and platforms.
- Model competing architectures and prototype discrete information security technologies to insure that applications programs are constructed with the highest security possibly in accordance with DCID directives.
- Perform risk analysis of competing models.
- Prepare information security policy recommendations for presentation to the security boards.
- Evaluate emerging INFOSEC requirements and technologies to assist CIO in identifying a long-term investment strategy.
- Provide INFOSEC engineering support to CIO projects to include the evaluation of proposed analytic tools.
- Identify viable INFOSEC architectures and designs.
- Analyze and define security requirements for Multilevel Security (MLS) issues.
- Design, develop, engineer, and implement solutions to MLS requirements.
- Gather and organize technical information about an organization's mission goals and needs, existing security products, and ongoing programs in the MLS arena.
- Perform risk analyses, which also include risk assessment.
- Produce and execute IT service continuity plan including technical service recovery plans.
- Train users and promote security awareness to ensure system security and to improve server and network efficiency.
- Coordinate implementation of computer system plan with establishment personnel and outside vendors.
- Maintain permanent fleet cryptologic and carry-on direct support systems required in special land, sea surface and subsurface operations.
Knowledge, Skills and Abilities:
- Computers and Electronics - Knowledge of circuit boards, processors, chips, electronic equipment, and computer hardware and software, including applications and programming.
- Customer and Personal Service - Knowledge of principles and processes for providing customer and personal services. This includes customer needs assessment, meeting quality standards for services, and evaluation of customer satisfaction.
- Administration and Management - Knowledge of business and management principles involved in strategic planning, resource allocation, human resources modeling, leadership technique, production methods, and coordination of people and resources.
- Engineering and Technology - Knowledge of the practical application of engineering science and technology. This includes applying principles, techniques, procedures, and equipment to the design and production of various goods and services.
- Telecommunications - Knowledge of transmission, broadcasting, switching, control, and operation of telecommunications systems.
- Education and Training - Knowledge of principles and methods for curriculum and training design, teaching and instruction for individuals and groups, and the measurement of training effects.
- English Language - Knowledge of the structure and content of the English language including the meaning and spelling of words, rules of composition, and grammar.
- Law and Government - Knowledge of laws, legal codes, court procedures, precedents, government regulations, executive orders, rules, and the democratic political process.
- Communications and Media - Knowledge of media production, communication, and dissemination techniques and methods. This includes alternative ways to inform and entertain via written, oral, and visual media.
- Public Safety and Security - Knowledge of relevant equipment, policies, procedures, and strategies to promote effective local, state, or national security operations for the protection of people, data, property, and institutions.
- Active Learning - Understanding the implications of new information for both current and future problem-solving and decision-making.
- Reading Comprehension - Understanding written sentences and paragraphs in work related documents.
- Systems Evaluation - Identifying measures or indicators of system performance and the actions needed to improve or correct performance, relative to the goals of the system.
- Critical Thinking - Using logic and reasoning to identify the strengths and weaknesses of alternative solutions, conclusions or approaches to problems.
- Active Listening - Giving full attention to what other people are saying, taking time to understand the points being made, asking questions as appropriate, and not interrupting at inappropriate times.
- Time Management - Managing one's own time and the time of others.
- Systems Analysis - Determining how a system should work and how changes in conditions, operations, and the environment will affect outcomes.
- Troubleshooting - Determining causes of operating errors and deciding what to do about it.
- Judgment and Decision Making - Considering the relative costs and benefits of potential actions to choose the most appropriate one.
- Writing - Communicating effectively in writing as appropriate for the needs of the audience.
- Inductive Reasoning - The ability to combine pieces of information to form general rules or conclusions (includes finding a relationship among seemingly unrelated events).
- Problem Sensitivity - The ability to tell when something is wrong or is likely to go wrong. It does not involve solving the problem, only recognizing there is a problem.
- Near Vision - The ability to see details at close range (within a few feet of the observer).
- Oral Comprehension - The ability to listen to and understand information and ideas presented through spoken words and sentences.
- Deductive Reasoning - The ability to apply general rules to specific problems to produce answers that make sense.
- Oral Expression - The ability to communicate information and ideas in speaking so others will understand.
- Written Comprehension - The ability to read and understand information and ideas presented in writing.
- Finger Dexterity - The ability to make precisy coordinated movements of the fingers of one or both hands to grasp, manipulate, or assemble very small objects.
- Information Ordering - The ability to arrange things or actions in a certain order or pattern according to a specific rule or set of rules (e.g., patterns of numbers, letters, words, pictures, mathematical operations).
- Category Flexibility - The ability to generate or use different sets of rules for combining or grouping things in different ways.
Tools used in this occupation:
- Desktop computers
- Mainframe computers
- Network analyzers - Local area network LAN analyzers
- Notebook computers
- Protocol analyzers
Technology used in this occupation:
- Authentication server software - Akoura SmartToken; IBM Tivoli Identity Management TIM; Password management software; Remote authentication dial-in user service RADIUS software
- Internet directory services software - Active directory software; Berkeley Internet Domain Name BIND software; Domain name system DNS software; Network directory services software
- Network monitoring software - Network, hardware, and software auditing software; Quest BigBrother; Sun Microsystems NetManage; System testing software
- Network security or virtual private network VPN management software - Intrusion detection system IDS software; Intrusion prevention system IPS software; Network and system vulnerability assessment software; Snort intrusion detection technology
- Transaction security and virus protection software - Ping software; Stack smashing protection SSP software; Symantec Corporation Norton Antivirus; Virus scanning software
