Position Summary: The CERT Program is part of the SEI, a federally funded research and development center at Carnegie Mellon University in Pittsburgh, Pennsylvania. The CERT Program engages in cutting-edge research and development and develops and transitions disciplined approaches to improve the survivability and resiliency of the DoD, federal civilian agencies, private sector organizations and their networked information systems. The individual in this position will work as a member of the Cybersecurity Assurance Team within the Cyber Risk & Resilience Directorate. The team develops solutions (in the form of frameworks, models, tools, policies, practices, technical guidance, and training) that allow organizations to identify, analyze, and manage organizational, operational, and technical risks to mission-critical assets, processes, systems, and infrastructures. The individual will conduct applied research and perform assessments, diagnostics, and analysis techniques to better understand and mitigate risks to cyber environments and the organizational processes that depend on them. Activities will include close work with customers from a variety of organizations, including DoD, government agencies, and commercial organizations.
Minimum Qualifications and Requirements:
Education/Training: BS in computer science, software engineering, information systems, or a related scientific/technical field with eight (8) years’ experience.
Licenses: CISSP or CISA
Experience: Professional experience in Industrial Control Systems Security in the Water, Chemical, or Energy Sectors. Operational experience in Critical Infrastructure. Experience with and applied knowledge in: data Analysis, Statistics, and Statistical Tools for quantitative methods; information technology and telecommunications systems; cyber security, survivability, and resilience concepts and issues; critical Infrastructure and Key Resources; software and systems engineering.
Skills/Abilities: Must exhibit the following skills and abilities: understanding of information technology and telecommunications systems; working knowledge of network interoperability, cyber security, and survivability issues, including cyber security best practices and standards; working knowledge of DHS critical infrastructure sectors and related security and resilience issues; development and delivery of information and infrastructure security risk and vulnerability evaluations; ability to conduct analytical studies and investigations; reasoning and problem-solving skills; ability to work independently with limited supervision; ability to interact effectively with customer and to represent the SEI and its capabilities; ability to work well as a member of a cooperative team; ability to work in a matrix organizational structure; ability to recognize and deal appropriately with confidential and sensitive information; ability to implement project plans, monitor project budgets, and identify and mitigate project risks; leadership and mentoring skills; excellent written and oral communication skills; ability to contribute to technical research white papers and reports; ability to prepare papers and deliver presentations to technical and non-technical audiences; ability to contribute to customer technical exchanges and marketing presentations; participation in professional society activities, particularly IEEE and ACM.
Physical/Mobility: Primarily sedentary in an office setting with some mobility. Ability to travel frequently to various locations within the SEI and CMU community, customer sites, conferences, and offsite meetings.
Environmental Conditions: Close contact with computer for extended periods of time.
Mental: Strong interest in the human, managerial, and technical aspects of cyber security is critical for this position as are these abilities: take or share leadership role in technical projects; work meticulously with careful attention to detail; meet deadlines while working on multiple tasks – sometimes under pressure and with shifting priorities; deal collaboratively, diplomatically, and successfully with customers, co-workers and other professional colleagues, managers, and staff; ability to understand the big picture, direction, and goals of an effort; ability to develop and communicate innovative ideas; ability to demonstrate initiative and to quickly learn new procedures, techniques, approaches, etc.
Other: Strong interest in cyber security and critical infrastructure protection analysis basis research, applied research, and development. U.S. Citizenship is required. Applicants selected will be subject to a security investigation and must meet eligibility requirements for access to classified information, and maintain that clearance as a condition of employment.
Preferred Qualifications and Requirements:
Education/Training: MS in computer science, software engineering, information systems, or a related scientific/technical field with five (5) years’ experience. PhD in computer science, software engineering, information systems, or a related scientific/technical field with two (2) years’ experience.
Licenses: CISSP, CISM, GIAC, or similar; certifications from the audit discipline (such as CISA) are also acceptable.
Experience: In addition to the minimum experience above, preferred experience includes: experience in both physical and cyber aspects of security; familiarity with resilience concepts; familiarity with process improvement models such as CMMI or SixSigma, TQM, ISO9000, CERT-RMM; familiarity with standards for measurement (including ISO 15939); familiarity with NIST 800-series standards for information security; familiarity with the DoD DIACAP standard for information assurance certification and accreditation; familiarity with standards for security (ISO 27000), business continuity (BS 25999), and IT operations (ISO 20000); working in a team environment on collaborative projects in critical infrastructure sectors involving network, system or data security; experience employing software engineering techniques in designing and developing distributed, secure software, and experience with / knowledge of any of the following; system administration; networking; firewalls, intrusion detection systems, and other security technologies; application development/programming; relational databases.
Skills/Abilities: In addition to the minimum skills/abilities above, preferred skills/abilities include: ability to lead work teams as needed; consulting skills; demonstrated ability to deliver coursework and training.
Accountability: The individual will implement and participate in the planning and execution of projects leading to technical results. The individual will also contribute to project, department, or program objectives and planning document development. The individual will keep in confidence sensitive information such as customer processes, risks, vulnerabilities, and internal work products, whether for eventual public or private distribution.
Direction: The individual is expected to act independently using CMU, SEI, and CERT defined policies, practices, and procedures – within the scope of assigned work.
Decisions: The individual must make sound technical decisions with little supervision. The individual must accurately represent the program in interactions with customers, sponsors, and the public. The individual is expected to perform analysis on-site at customer locations and immediately assess potential vulnerabilities requiring further investigation.
Supervisory Responsibilities: This position could involve the training and oversight of the work of other staff members, graduate students, resident affiliates, visiting scientists, and independent contractors. Depending on research project or customer work plan, position may involve task leadership.
Job Functions or Responsibilities:
30% Participate in the examination, analysis, and documentation of assessments, diagnostics, and analysis techniques for information and infrastructure security; examine data on cyber security and technology risks to identify problem areas and propose mitigation alternatives.
25% Participate in the delivery of existing CERT cyber security, resilience, and risk assessment and analysis approaches with customers and partners; participate in research, analysis, and documentation of cyber security issues, concerns, and risks at customer locations.
20% Participate in research into innovative and cutting-edge tools, techniques, and methods to improve cyber security and resilience; transition research into applied knowledge for customers.
10% Deliver courses in operational resilience management, cyber security management, and information security risk management.
5% Contribute to conferences and meetings; participate in marketing calls and technical exchanges with clients; give talks and lectures as appropriate; participate on working groups for subjects of interest.
5% Contribute to and review the literature in cyber security, resilience, and software engineering.
5% Provide assistance and input to other teams and projects within the SEI.
100% Total Effort
Organizational Chart: Director CERT Program > Technical Director, Risk and Resilience Directorate > Technical Manager, Cybersecurity Assurance team > Information Security Critical Infrastructure Analyst
Carnegie Mellon University is an EEO/Affirmative Action Employer – M/F/Disability/Veteran