Security Modernization Specialist Mid

The Security Modernization Specialist Mid evaluates the Agency's current enterprise architecture, tools, and processes against CISA's Zero Trust Maturity Model, then updates the Agency's ZTA Implementation Plan and drafts/updates the OIT Zero Trust Optimization Roadmap across all ZT focus areas — Identity, Devices, Networks, Applications & Workloads, Data, Visibility & Analytics, Automation & Orchestration, and Governance. It supports the Zero Trust Architecture Implementation & Optimization Integrated Project Team (IPT), builds consensus across working groups, and tracks ZTA risks, issues, and metrics through to resolution. The position also maintains BI dashboards and technical/executive-facing documentation that communicate the Agency's ZTA maturity progress by pillar. 

• Serve as Zero Trust SME and strategic consultant to Government leadership; assist in incorporating ZT concepts per M-22-09, CISA's Zero Trust Maturity Model, NIST SP 800-207, DoD's ZT Reference Architecture, and EO 14028. 
• Evaluate the Agency's Enterprise Architecture, tools, configurations, and SOPs from a ZTA lens; identify further-adoption opportunities.
• Identify technology/capability gaps; evaluate products and make tool/technology recommendations to mature ZTA capability levels.
• Update the Agency's ZTA Implementation Plan and draft/update the OIT Zero Trust Optimization Roadmap across all ZT focus areas (Identity, Devices, Networks, Applications & Workloads, Data, Visibility & Analytics, Automation & Orchestration, Governance). 
• Draft and maintain the Agency's Security Modernization Strategy and support the ZTA Implementation & Optimization IPT, working groups, and consensus-building.
• Prioritize modernization initiatives and track ZTA risks/issues/blockers; develop and track Security Modernization metrics.
• Maintain the SecMod/ZT JIRA project board and an enterprise Integrated Master Schedule/Gantt chart; develop single-pane-of-glass BI dashboards tracking ZTA maturity per pillar.
• Develop technical documentation, non-technical executive summaries, and briefing materials supporting security modernization efforts. 

• Minimum 5 years of professional experience in information assurance, cybersecurity, risk management, or compliance; or, with a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, 3 years of such experience.
• One of the following (per PWS Section B — Security Modernization): ISC2 CISSP; ISACA CISM; ISACA CRISC; GIAC GCED; CompTIA CEH.

• US Citizenship / No dual

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

• Demonstrated knowledge/experience with:
  • M-22-09; Zero Trust Architecture pillars;
  • CISA Zero Trust Maturity Model;
  • NIST Zero Trust Architectural Model;
  • DoD Zero Trust Reference Architecture;
  • Risk Assessments;
  • NIST SP 800-37 RMF;
  • NIST Cybersecurity Framework;
  • NIST SP 800-53 controls;
  • POA&M management;
• System design/configuration security impact analysis; and security policy writing.

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.