**COMPUTER SPECIALIST (Security),**

**GS-0334-14**

# INTRODUCTION

The (Agency/Department) mission is to ..................

The mission of the Office of Information Resource Management (OIRM) is
to provide leadership and technical direction to all xxxx ADP customers
in the areas of ADP production operations and control; systems equipment
and data communications configuration, systems software maintenance;
customer support; ADP training; systems acceptability testing;
applications design and documentation; and application programming in
support of the (Agency/Department) mission.

The incumbent contributes to the mission of the xxxx by planning,
directing, staffing, evaluating and coordinating and being assigned the
overall responsibility for the Xxxx ADP Security Program, to be in full
compliance with all Federal policies, procedures and standards. The
incumbent is the focal point for all ADP system security matters;
manages the implementation and execution of the xxxx ADP Security
Program; and ensures effective implementation and enforcement of all ADP
security regulations. The ADP Security Program includes provisions for
site security, application and data security, compliance with personnel
clearance procedures, security training program, a risk management
program and audit and evaluation of the ADP security program's
effectiveness.

# MAJOR DUTIES

-Serves as the expert authority to manage the xxxx Information
Technology Security functions. Sets goals for the xxxx-wide security
program to fulfill its objectives. Determines resource needs and
allocates resources. Serves as the key consultant and authority to
higher level management on security matters.

-Responsible for the overall management and program direction for the
xxxx's Security Program. Functions as the principal management and
technical expert on ADP Security in support of xxxx-wide operations.
Plans, implements, and evaluates comprehensive management plans and
actions with the objective to identify solutions or improvement to ADP
security measures and controls throughout the xxxx. Responsible for long
range planning, developing budget, prioritizing and scheduling program
activities. Formulates and implements approved enhancements, software
and controls, policy and procedures for various computer systems to
ensure appropriate levels of security. Responsible for the development
or acquisition of systems software tools and support services for the
assignment and management of passwords, user ID's and other software
security mechanisms.

-Oversees periodic reviews and evaluations of existing software and
procedures and provides methods of reporting and correcting ADP security
violations or breakdowns. Certifies these systems in a manner consistent
with the schedules of ADP Security Audit Program.

-Functions as the principal management expert on risk management,
security and contingency planning programs for xxxx-wide ADP systems.
Designs and implements measures to protect the installations from
physical destruction or theft. Assures that backup procedures are in
place for recovery from loss or destruction of data and program files,
or from physical damage to the installation.

-Answers the conduct of investigations to determine cause for suspending
operations partially or completely, upon detection of actions which
appear to compromise or jeopardize the security of such operations.
Documents and recommends suspensions as necessary. Recommends to the
director, Office of Data Systems that operations be suspended, partially
or completely, upon detection of actions which appear to compromise or
jeopardize the security of such operations. This suspension shall remain
in effect until removed by the Director. Reports to senior management
any system failure leading to unauthorized access to information or data
categorized as sensitive.

-Reviews solicitations and contracts involving sensitive applications to
ensure compliance with existing ADP security policy; reviews existing
contracts involving sensitive applications to determine the need for
increased and/or more definite security features; recommends the
alteration or re-negotiation of such contracts as required.

-Ensures that all positions associated with the design operations or
maintenance of the BIO computer systems or having access to data in the
(Agency/Department) computer systems, regardless of the location of the
position, are classified as Critical Sensitive, Noncritical/Sensitive or
Noncritical/Nonsensitive. Also that the individual in the position has
been screened and an access authorization has been granted based on the
positive results of a background investigation.

-Ensures that standard security procedures and protocols governing
network operations are developed and promulgated. Ensures that security
measures and procedures used at network nodes fully support the security
integrity of the network and comply with the applicable security
directives.

-Maintains awareness of potential threats to the security and/or
integrity of xxxx data; stays abreast of threat activity to include
computer viruses, patterns and methods of unauthorized intrusion in
other government computer systems; communicates effectively and in a
timely manner with all staff organizations regarding potential threats;
conducts security briefings and other types of security training to
foster an awareness of the ADP security program throughout the Xxxx.

-Oversees an ADP Security Audit Program for conducting periodic
evaluations and reviews to insure the effective implementation of
security safeguards and that the security program is in compliance with
existing directives and appropriate to the risks and sensitivity of each
computer application. The frequency of these reviews shall be determined
by the ADP Security Officer, but all sensitive installations and
applications shall be re-certified at least every three years.

-Responsible for the establishment of risk analysis procedures and
ensures that risk analysis techniques are applied to all new or
significant changes to computer applications in determining security
safeguards and defining security specifications; approves security
specifications for all applications or changes prior to programming.

-Prescribes procedures for the retention of documentation related to
personnel screenings, risk analysis, certifications, re-certifications
and audit reviews.

-Reviews system tests to assure that the systems meet approved security
specifications and that security provisions are adequate for the
application.

-Conducts security monitoring to ensure that security safeguards
implemented within an applications system or installation are not
circumvented. Reviews audits and other data collected for the purpose of
searching out incidents involving data security and takes or recommends
corrective action. Attempts test penetrations of the xxxx's applications
systems and computer installation to determine the adequacy of security
safeguards.

FACTORS

1.  Knowledge Required by the Position

-Knowledge of and ability to implement management skills and concepts
associated with the planning, design, implementation and evaluation of a
nation-wide, comprehensive security program with multiple, decentralized
users.

-Mastery of the specialized areas of security systems software design,
sufficient to functions as the xxxx technical authority, and to provide
long-range planning and forecasting for the computer security program of
the bureau.

-Ability to organize and allocate resources and mobilize response teams,
task forces and contractors to resolve critical problems, involving
sensitive, classified and proprietary data security arising out of the
planned and on-going upgrading of the xxxx's current computer system and
telecommunications network.

-Knowledge of overall Federal ADP Security policy as promulgated by the
National Security Agency and National Institute for Standards and
Technology (NIST) so as to develop xxxx directives to implement legal
and executive policy actions.

-Knowledge of program design and system software routines, such as those
providing an audit trail of activities against sensitive data files.

-Knowledge of programming techniques, ADP equipment characteristics, and
xxxx and xxxx security regulations to evaluate the effectiveness of
systems, devices, procedures and methods used to safeguard classified
and privacy data in computer accessible media.

-Knowledge of the various ways in which computer security can be
compromised, e.g., unauthorized use of access codes, or finding a
telephone connection, or use of electromagnetic monitoring devices to
read output going to any of the seven regional centers and terminals.

-Knowledge of methods used to assess the levels of risk associated with
an application, a piece of equipment, or a network.

-Knowledge of the administration and management of multi-dimensional
current generation operating systems supporting local and remote batch,
time sharing and transaction processing, and data base management, so as
to evaluate overall performance of the computing facility.

-Knowledge of contingency planning to assure that adequate emergency
response back up operations, and post-disaster recovery plans are
formulated for the bureau's computer facilities.

-Knowledge of ADP audit and evaluation techniques to review systems at
all stages of development and operations for effectiveness and
efficiency, compliance with standards and procedures, performance
according to specifications, and certification of the adequacy of
security safeguards.

-Skill in oral and written communications in order to document and
promote the computer security program at all organizational levels.

2.  Supervisory Controls

-The incumbent works under the administrative direction of the Director,
Office of Information Resource Management. He has provided general
administrative direction with assignments in terms of broadly defined
statements of mission or functions. The incumbent is responsible for
planning, designing and carrying out the data security program, related
projects, studies or other work performed independently. The incumbent
keeps the supervisor informed of potential controversial problems, or
matters of far-reaching implications. The results of the work are
considered technically authoritative and are normally accepted within
significant change.

3\. Guidelines

-A wide variety of guidelines apply to computer security, including DOD,
NSA, NIST and commercial technical publications. Because the nation-wide
systems of the xxxx are particularly intricate, in terms of the
networking of the various mainframe and dedicated computers,
microcomputers, and various terminals to the xxxx headquarters, and
between headquarters and among the xxxx area offices, nationwide, the
incumbent must use substantial judgement in determining the
effectiveness of xxxx and/or installation security plans, risk analyses,
and management plans in meeting the guidelines and xxx needs. The
incumbent is recognized as a technical authority in the development and
interpretation of the (Agency/Department) data security policies and
guidelines.

4\. Complexity

-Plans, implements, operates, and evaluates the computer security
program and activities for the Xxxx involving headquarters and
nationwide data processing. The responsibility is complicated by broad
program and technical problems, in-depth systemic review of the program,
and recommendations concerning new or major modifications to policies or
practices. Projects require an unusual depth of analysis, characterized
by the need for significant departures from established practices.
Computer security in the Bureau has been low priority due to lack of
resources. Therefore, this position will deal with problems that
characterized relatively new emphasis program and policy.

-Deciding what needs to be done typically involves assessment of
situations complicated by conflicting or insufficient data which must be
analyzed to determine the applicability of established methods. This
includes new applications or equipment and the degree to which they
implement the computer security programs. Risk analysis preparation for
both classified and unclassified applications and equipment, and the
conduct of audits of computer security measures are required. The
technical difficulty of the work is substantially impacted by the
growing intricacy of the xxxx's nation-wide computer systems and
telecommunications networks, and the increase in the number of ways that
security could be compromised; for example, computer "hackers" using
personal computers to try penetrating remote and secured computer
systems. ADP and data security are consistently evolving disciplines,
often requiring significant departures from previous approaches and
extensions of traditional techniques; thus, requiring development of new
methodologies.

5\. Scope and Effect

-The purpose of the data and computer security program is to provide
adequate protection of all sensitive automated data in the Bureau, and
provide adequate contingency planning and efficiency of operations.

The effective operation of this program will ensure optimal allocation
of security resources, minimize unwarranted invasion of privacy and
potential fraud, and ensure efficient and continued operation critical
to xxxx programs. The work involves the resolution of critical problems
in bureau-wide systems and the development of new approaches and
techniques for use by others. More importantly, the work involves
discernment of situations where advancements in computer security
technology can be fruitfully employed. The work involves serving as a
national expert and consultant within the specialty area of data and
computer systems security and affects the basic structuring of automated
systems that support a variety of functional operations in the xxxx.
Advice and guidance provided by the incumbent affects the work of other
ADP professionals and users through the Bureau.

6.  Personal Contacts and Purpose of Contacts

-A wide range of personal contacts is required, including: policy making
and auditing officials of the Office of Management and Budget, the
General Accounting Office, General Services Administration, and the
(Department/Agency). Technical experts in the area of data security at
the National Security Agency, National Institute of Standards and
Technology and other Federal Agencies and private organizations; Law
Enforcement Agencies at Federal, State, County and Municipal levels.
Heads of offices, regional computer centers throughout the Bureau and
other subordinate organizations and personnel counterparts in the
information systems and data security professional areas in other
government agencies, societies, standardization committees and symposia.

-Contacts are made for determining requirements, policy and procedures
for the data security program; negotiating areas of organizational
responsibility; giving and receiving guidance and directions; conducting
security briefings and providing expert advice and assistance in all
areas of data security; learning new technology and procedures, and
resolving operational and administrative and personnel problems
respective to security activities along with an interchange of security
intelligence with a variety of law enforcement agencies. In addition,
contacts often require the exercise of considerable tact and diplomacy
in persuading others of the long-run benefits of courses of action that
may involve temporary disruptions in work programs, or in convincing ADP
operations personnel that additional efforts are needed in
[managing]{.underline} access to computer facilities.

7.  Physical Demands

-No unusual physical effort is involved. The work is mostly sedentary.
Travel is required to effectively support and consult with xxxx ADP
installation managers, to attend meetings, symposia, standardization
committees, seminars, etc., as well as to other field locations
throughout the bureau.

8.  Work Environment

-Work is performed in a typical office setting with no unusual
environment demands, nor exposure to hazards.

OTHER REQUIREMENT

Due in part to security sensitive and to oversight security management
responsibilities, assigned to the position, the incumbent is required to
possess a Critical Sensitive classification.

In performance of work, the incumbent is expected to operate a
government owned or leased motor vehicle; therefore, a valid driver's
license is required.