ITSPEC (INFOSEC)
1. Serves as the Computer Security (COMPUSEC) Manager. Protects and maintains the availability, integrity, confidentiality, and accountability of information system resources and information processed throughout the system's life cycle. Establishes and publishes squadron policy to manage the COMPUSEC program. Disseminates information and ensures computer security practices are adhered to by all functional areas in-garrison and in support of deployed war-fighting personnel. Reviews, analyzes, and validates certification and accreditation packages. Continuously identifies and analyzes threats and vulnerabilities to the information systems to maintain an appropriate level of protection. Ensures computer software designs address information system security requirements. Accomplishes risk analysis, security testing, and certification due to modifications or changes to computer systems. Evaluates, assesses, or locally tests and approves all hardware, software, and firmware products that provide security features prior to use on any accredited information system or network. Certifies all software prior to installation and use on communications and computer systems. Executes computer security plans and enforces mandatory access control techniques such as trusted routers, bastion hosts, gateways, firewalls, or other methods of information systems protection. 2. Manages the Information Assurance Program. Implements procedures to ensure protection of information transmitted to the squadron, among units in the squadron, and from the squadron units using local or wide area networks, the worldwide web or other communications modes. Utilizes current and future multi-level security products collectively to provide data integrity, confidentiality, authentication, non-repudiation, and access control of the Local Area Network (LAN). Reports to Major Command (MAJCOM), Air Force Communications Agency (AFCA), National Security Agency (NSA), and Air Force Computer Emergency Response Team (AFCERT) all incidents involving viruses, tampering, or unauthorized system entry. Controls access to prevent unauthorized persons from using network facilities. Limits access to privileged programs (i.e., operating system, system parameter and configuration files, and databases), utilities, and security-relevant programs/data files to authorized personnel. Implements methods to prevent or minimize direct access, electronic or other forms of eavesdropping, interpreting electro-mechanical emanations, electronic intercept, telemetry interpretation, and other techniques designed to gain unauthorized access to Automated Data Processing (ADP) information, equipment, or processes. Recognizes such potential and defines vulnerabilities and oversees the installation of physical and technical security barriers to prevent others from improperly obtaining such information. 3. Serves as the Communications Security (COMSEC) Manager for all cryptographic activities including managing the Cryptographic Access Program (CAP). Formulates and develops communications security criteria and requirements for inclusion in mobility, contingency, and exercise plans. Maintains accountability for sensitive cryptographic materials and related COMSEC information. Oversees issuance of COMSEC materials. Maintains COMSEC inventory on the Computerized Management of COMSEC Material (CM2) database. Prepares and evaluates written plans for emergency actions and ensures personnel are fully qualified in the execution of plans. Investigates security incidents to determine the possibility of compromise to COMSEC materials and ensures documentation and reporting to appropriate channels. Performs destruction, receiving, issuing, and inspecting COMSEC material within the most stringent timelines. Furnishes written guidance to user accounts concurring effective dates, accounting procedures, destruction requirements, and physical security of COMSEC keying materials. Performs semi-annual functional reviews of all COMSEC user accounts, physically inspecting the user's COMSEC facilities, reviewing procedures, and audit of all cryptographic holdings. As required, manages the Certification Authority Workstation. Administers the CAP by conducting briefings prior to granting access to cryptographic information. Documents cryptographic access certificates and acts as liaison for scheduling polygraph examinations of personnel enrolled in the program. GENERAL
Experience:
Experience, education or training that has provided a basic knowledge of data processing functions and general management principles that enabled the applicant to understand the stages required to automate a work process. Experience may have been gained in work such as computer operator or assistant, computer sales representative, program analyst, or other positions that required the use or adaptation of computer programs and systems. SPECIALIZED
Experience:
Must have at least 36 months experience, education, or training that approaches techniques and requirements appropriate to an assigned computer applications area or computer specialty area in an organization. Experience planning the sequence of actions necessary to accomplish the assignment where this entailed coordination with others outside the organizational unit and development of project controls. Experience that required adaptations of guidelines or precedents to meet the needs of the assignment. Experience preparing documentation on cost/benefit studies where is involved summarizing the material and organizing it in a logical fashion. PLACEMENT FACTORS:
-- Knowledge of concepts, principles, methods, and practices in the information systems security to design, develop, implement, and maintain secure systems and services, assess the effectiveness of current systems security and services, evaluate the feasibility of new systems security and services, and provide advice and guidance on complex issues. -- In-depth knowledge of a wide variety of communications and computer security concepts, principles, practices, and governing directives to interpret, disseminate, and adapt local policy, and implement instructions for unit and/or squadron personnel. Incumbent must be capable of analyzing and resolving difficult and complex security problems. -- In-depth knowledge of communications and computer software and programs to protect systems from viruses, data tampering, and unauthorized system entry. This includes knowledge of computer-based instructional software and other media to increase and reinforce communications-computer security awareness. -- In-depth knowledge of the AFEKMS program and related hardware and software, including knowledge of operating systems, local COMSEC Management Software, relational data base management systems, computer-communications software, and Computerized Management of COMSEC Material (CM2). -- Knowledge of a wide range of communications and computer techniques, requirements, methods, sources, and procedures, including familiarity with approaches used by ADP and communications organizations in other agencies and/or the private sector to accomplish a variety of assignments in the communications and computer security specialty area. -- Knowledge of system software and systems development life cycles including systems documentation, design development, configuration management, cost analysis, data administration, systems integration, and testing. -- Comprehensive knowledge of government and industry communications and computer systems, concepts, principles, and practices relative to the systems security function. In-depth knowledge and ability sufficient to serve as the focal point for information security, providing authoritative advice, and assistance on complex, technical, controversial, and precedent setting matters to improve the Information Assurance program comprising many unique organizations and large, complex computer and communications security systems. -- Knowledge and skill sufficient to develop and evaluate program documentation to include:
mission need statements, operational requirements documents and support plans, specifications, proposals, and plans for systems operational test and evaluation of communications and information security systems. -- Knowledge of information systems security principles and methods to design, develop, implement, and manage systems, networks, and data that ensure confidentiality, integrity, and availability. -- Knowledge of methods for evaluating, implementing, and disseminating information systems security tools and procedures to ensure, protect, and restore information security systems and network services and capabilities -- Knowledge of Security Awareness Training and Education (SATE) security training program, training materials, and sources -- Knowledge of information systems security certification and accreditation requirements to monitor and evaluate systems' compliance with those requirements. -- Skill in oral and written communication to prepare and present reports, interpret policies and guidelines, provide advice and guidance to customers, and represent the organization in interactions with other organizations. -- Ability to provide technical leadership on projects that require group efforts. -- Knowledge of strapping and configuration options of cryptographic units.
Estimated Salary: $20 to $28 per hour based on qualifications.
Experience:
Experience, education or training that has provided a basic knowledge of data processing functions and general management principles that enabled the applicant to understand the stages required to automate a work process. Experience may have been gained in work such as computer operator or assistant, computer sales representative, program analyst, or other positions that required the use or adaptation of computer programs and systems. SPECIALIZED
Experience:
Must have at least 36 months experience, education, or training that approaches techniques and requirements appropriate to an assigned computer applications area or computer specialty area in an organization. Experience planning the sequence of actions necessary to accomplish the assignment where this entailed coordination with others outside the organizational unit and development of project controls. Experience that required adaptations of guidelines or precedents to meet the needs of the assignment. Experience preparing documentation on cost/benefit studies where is involved summarizing the material and organizing it in a logical fashion. PLACEMENT FACTORS:
-- Knowledge of concepts, principles, methods, and practices in the information systems security to design, develop, implement, and maintain secure systems and services, assess the effectiveness of current systems security and services, evaluate the feasibility of new systems security and services, and provide advice and guidance on complex issues. -- In-depth knowledge of a wide variety of communications and computer security concepts, principles, practices, and governing directives to interpret, disseminate, and adapt local policy, and implement instructions for unit and/or squadron personnel. Incumbent must be capable of analyzing and resolving difficult and complex security problems. -- In-depth knowledge of communications and computer software and programs to protect systems from viruses, data tampering, and unauthorized system entry. This includes knowledge of computer-based instructional software and other media to increase and reinforce communications-computer security awareness. -- In-depth knowledge of the AFEKMS program and related hardware and software, including knowledge of operating systems, local COMSEC Management Software, relational data base management systems, computer-communications software, and Computerized Management of COMSEC Material (CM2). -- Knowledge of a wide range of communications and computer techniques, requirements, methods, sources, and procedures, including familiarity with approaches used by ADP and communications organizations in other agencies and/or the private sector to accomplish a variety of assignments in the communications and computer security specialty area. -- Knowledge of system software and systems development life cycles including systems documentation, design development, configuration management, cost analysis, data administration, systems integration, and testing. -- Comprehensive knowledge of government and industry communications and computer systems, concepts, principles, and practices relative to the systems security function. In-depth knowledge and ability sufficient to serve as the focal point for information security, providing authoritative advice, and assistance on complex, technical, controversial, and precedent setting matters to improve the Information Assurance program comprising many unique organizations and large, complex computer and communications security systems. -- Knowledge and skill sufficient to develop and evaluate program documentation to include:
mission need statements, operational requirements documents and support plans, specifications, proposals, and plans for systems operational test and evaluation of communications and information security systems. -- Knowledge of information systems security principles and methods to design, develop, implement, and manage systems, networks, and data that ensure confidentiality, integrity, and availability. -- Knowledge of methods for evaluating, implementing, and disseminating information systems security tools and procedures to ensure, protect, and restore information security systems and network services and capabilities -- Knowledge of Security Awareness Training and Education (SATE) security training program, training materials, and sources -- Knowledge of information systems security certification and accreditation requirements to monitor and evaluate systems' compliance with those requirements. -- Skill in oral and written communication to prepare and present reports, interpret policies and guidelines, provide advice and guidance to customers, and represent the organization in interactions with other organizations. -- Ability to provide technical leadership on projects that require group efforts. -- Knowledge of strapping and configuration options of cryptographic units.
- Department:
2210 Information Technology Management - Salary Range:
$65,141 to $84,682 per year
Estimated Salary: $20 to $28 per hour based on qualifications.
|
|
 | |
