Cybersecurity SME

Responsibilities

• Responsible for the maintenance and support of DoD and Air Force computing systems and networks (both unclassified and classified).
• Require the individual to obtain/maintain classified systems administrative privileges for SIPRNet and other systems.
• Perform system trusted downloads, burn classified Compact Discs (CDs), and maintain and update host systems.
• Have knowledge of the Systems Security Engineering disciplines to include Anti‑Tamper, Trusted Systems & Networks, Cybersecurity, Hardware/Software/Firmware Assurance, Supply Chain Risk Management, Acquisition Security, Cyber Resiliency, and Information Protection.
• Support the Systems Engineer with program engineering milestone reviews, test planning, and certification and accreditation packages.
• Assist the Information Systems Security Manager (ISSM) and provide multi‑discipline expertise covering project management, system security engineering, system administration, and network administration.
• Provide direct support to assure compliance to the most current revision of the Security Directives applicable to Platform Information Technology (PIT), PITI and non‑PIT systems, including DoDI 8500.01, Cybersecurity, DoDI 8510.01, RMF for DoD IT, JSIG, NIST 800‑53, and directives/guidance identified in DoDI 5000.02.
• Provide cybersecurity support to assigned systems and assist in developing, modifying, reviewing, or coordinating items such as PIT determination package, cybersecurity strategy, System Security Plan (SSP), system controls traceability matrix, risk assessment report, plan of action and milestones, security assessment plan, and artifacts for program review and RFP.
• Assist in evaluating the technical implementation of the security design to ascertain that security software, hardware and firmware features affecting confidentiality, integrity, availability, accountability, and non‑repudiation have been implemented as documented in DCID 630, JSIG, DoDI 8500.01, DoDI 8510.01, and NIST 800‑53, and that the features perform properly; document and report IV&V test plans, results, anomaly reports, recommendations, activity reports and other special reports as required.
• Assist in performing cybersecurity site audits to verify architecture analysis, cybersecurity requirements and controls, verify mitigation actions, witness cybersecurity testing and evaluation, and support final approval for Interim Authority to Test (IATT), Interim Authority to Operate (IATO), Authority To Operate (ATO), and/or Authority To Connect (ATC).
• Assist in identifying the Software Assurance (SWA) pedigree (including platform software) and QA issues and documenting the results.
• Assist the Government in conducting Supply Chain Risk Management (SCRM).
• Assist in developing and documenting SCRM plans and implementation activities in appropriate acquisition and security documents, including but not limited to acquisition strategy, SEP, PPP, and SSP.

• Advanced Degree (MA/MS) and twelve (15) years of experience in the respective technical/professional discipline, five (5) of which must be in the DoD.
• OR, BA/BS degree, fifteen (18) years of experience in the respective technical/professional discipline, five (5) of which must be in the DoD.
• OR, twenty (24) years of IT and Cybersecurity experience.
• SME subject matter expertise for rapid acquisition activities, including rapid prototyping and fielding conducted under AFGM 2018‑63‑146‑01 Rapid Acquisition Activities or subsequent publication.
• Proficiency with Windows Operating Systems (OS), Windows group policy objects, DoD Cybersecurity, National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), Security Technical Implementation Guides (STIGs), Endpoint Security System (SS)/Host‑based Security System (HBS), and DoD Public Key Infrastructure (PKI).
• Understanding of Security Directives applicable to Platform Information Technology (PIT), PITI and non‑PIT systems including DoDI 8500.01, Cybersecurity, DoDI 8510.01, RMF for DoD IT, JSIG, NIST 800‑53, and DoDI 5000.02.
• Developing and managing PIT determination packages, including cybersecurity strategy, System Security Plan (SSP), system controls…