IT Security Governance & Policy/Change Management:

• Facilitate meeting/agenda – Weekly Change Control Board (CCB)
• Validation/closure – post implementation
• Document meeting minutes
• Review current processes, suggest improves and efficiencies

• Provide response/supporting artifacts at the modal/program level to validate the implementation of controls per NIST/DOT requirements as needed.

• Create, review, manage and maintain program documentation
• Manage and maintain documents, policies, procedures, and SOPs for the modal cybersecurity program.
• Review cybersecurity program documents, policies, and procedures to ensure they adequately developed and in keeping with current best practices, federal law, regulations, and federal/departmental policy.
• Create a review system for ensuring all documents for the cybersecurity program are reviewed at least annually and/or as needed.

Cybersecurity and Information Technology (IT) Security:

• System Security Plan
• Business Impact Analysis
• Risk Assessment
• Contingency Plan
• Incident Response Plan
• Security Test and Evaluation (Plan and Results)
• Plan of Action and Milestones
• Certification Statement; and
• Accreditation Statement

Continuous Diagnostics and Mitigation (CDM):

• Analyze threats to identify gaps in current defensive posture.
• Ensure PHMSA’s CDM capabilities utilize or tie into departmental CDM capabilities and solutions.
• Conduct scans and track IOCs and vulnerabilities and communicate those out to DOT and PHMSA stake holders to include system owners, DOT SOC, and others.
• Configure and execute vulnerability scans enumerating vulnerabilities within PHMSA’s internal and external network.
• Analyze and prioritize specific activities designed to remediate discovered vulnerabilities such as patch deployment or configuration hardening.
• Effectively support and maintain DOT/PHMSA compliance efforts with Federal, State, and other industry information security reporting requirements and obligations.
• Respond to technical issues in a professional and timely manner.

• 
  Minimum of eight (8) years' experience
• Proficiency in implementation and management of cybersecurity related projects for the Federal government.
• Must have experience with security principles in relation to information technology risk management, vulnerability management, privacy assessments, and contingency planning.
• Expertise in applying standards and guidance from National Institute of Standard Special Publications (NIST SP), Federal Information Processing Standards (FIPS), Federal Information Security Management Act (FISMA), Clinger-Cohen, Patriot Act, Office of Management and Budget (OMB) A-130, the DOT Departmental Information Resources Management Manual (DIRMM), and related computer security guidance through ongoing examination and analysis of cybersecurity projects.
• Expertise in creating, reviewing, and analyzing system ATO documentation.
• Knowledge in formation and implementation of DOT cybersecurity policies to ensure confidentiality, integrity, and availability of DOT information systems.
• Proficiency with enterprise cybersecurity tools, such as: BigFix, Elastic Search, Splunk, ForeScout CounterACT, SailPoint, CyberARK, and Tenable Security Center.
• Expertise in detecting, mitigating, and troubleshooting security threats to network infrastructure, verifying vulnerability mitigation, and managing security assessments.
• Expertise in assessing current and emerging technologies, platforms, and applications to help ensure greater security and efficiencies.
• Must be familiar with CDM capabilities (Network asset management, Identity and Access Management, Network Security Management, Data Protection Management), the tools that support them and how they are deployed within an enterprise.
• Must have at least one Cybersecurity-related certification, for example: Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), GIAC Cloud Security Automation (GCSA), Certified Authorization Professional (CAP), GSDC Certified DevSecOps Engineer Certification or Global Information Assurance Certification (GIAC) Systems and Network Auditor (GSNA).
• Proficiency in applying standards and guidance from National Institute of Standard Special Publications (NIST SP), Federal Information Processing Standards (FIPS), Privacy Act, Federal Information Security Management Act (FISMA), Clinger-Cohen, Patriot Act, Office of Management and Budget (OMB) A-130 and related privacy guidance through ongoing examination and analysis of Privacy Threshold Analysis (PTAs), Privacy Impact Assessments (PIAs), and Systems of Records Notices (SORNs).