Knowledge of types and collection of persistent data. Applicable Knowledge of types of digital forensics data and how to recognize them. Applicable Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files. Applicable Skill in analyzing volatile data. Applicable Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems). Applicable Skill in developing and executing technical training programs and curricula. Applicable Skill in identifying and extracting data of forensic interest in diverse media (i.e., media forensics). Applicable Skill in identifying forensic footprints. Applicable Skill in preserving evidence integrity according to standard operating procedures or national standards. Applicable Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, Forensic Tool Kit [FTK]). Applicable Knowledge of basic concepts and practices of processing digital forensic data Applicable Knowledge of machine learning Applicable Knowledge of statistical methods Applicable Skill In data presentation and visual analytics Applicable Skill in experimental design Applicable Skill in pattern recognition and anomaly detection Applicable Skill in working with structured data Applicable Skill in working with unstructured data Applicable Knowledge of interpreted and compiled computer languages. Applicable Knowledge of low-level computer languages (e.g., assembly languages). Applicable Knowledge of programming language structures and logic. Applicable Knowledge of secure coding technologies. Applicable Knowledge of Unix command line (e.g., mkdir, mv, ls, passwd, grep). Applicable Skill in identifying common encoding techniques (e.g., Exclusive Disjunction [XOR], American Standard Code for Information Interchange [ASCII], Unicode, Base64, Uuencode, Uniform Resource Locator [URL] encode). Applicable Skill in reading Hexadecimal data. Applicable Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump). Applicable Skill in writing code that is compatible with legacy code (e.g., Common Business-Oriented Language [COBOL], FORTRAN IV) in a modern programming language (e.g., Java, C++). Applicable
Knowledge of database procedures used for documenting and querying reported incidents. Applicable Knowledge of disaster recovery and continuity of operations plans. Applicable Knowledge of enterprise incident response program, roles, and responsibilities. Applicable Knowledge of incident categories, incident responses, and timelines for responses. Applicable Knowledge of incident response and handling methodologies. Applicable Knowledge of root cause analysis for incidents. Applicable Skill in performing root cause analysis for incidents. Applicable Skill in recovering failed servers. Applicable Skill in using incident handling methodologies. Applicable Knowledge of fault tolerance. Applicable Knowledge of information assurance (IA) principles and methods that apply to software development. Applicable Knowledge of information assurance (IA) principles and organizational requirements to protect confidentiality, integrity, availability, authenticity, and non-repudiation of information and data. Applicable Knowledge of information assurance (IA) principles used to manage risks related to the use, processing, storage, and transmission of information or data. Applicable Knowledge of key concepts in security management (e.g., Release Management, Patch Management). Applicable Knowledge of organization's enterprise information security architecture system. Applicable Knowledge of parallel and distributed computing concepts. Applicable Knowledge of the Security Assessment and Authorization (SA&A) process. Applicable Skill in applying confidentiality, integrity, and availability principles. Applicable Skill in designing security controls based on information assurance (IA) principles and tenets. Applicable Skill in determining how a security system should work, including its resilience and dependability capabilities, and how changes in conditions, operations, or the environment will affect these outcomes. Applicable Skill in developing, testing, and implementing network infrastructure contingency and recovery plans. Applicable Skill in performing damage assessments. Applicable Skill in recognizing and categorizing types of vulnerabilities and associated attacks. Applicable Skill in securing network communications. Applicable Knowledge of frameworks for authorization and entitlement management (e.x. EPV, SSO, etc) Applicable
Skill in identifying, modifying, and manipulating applicable system components (iOS or Android) (e.g., passwords, user accounts, files) Applicable Skill in identifying, modifying, and manipulating applicable system components (Windows, Unix/Linux, Mac OS/OS X, iOS and/or Android) Updated Knowledge of service catalogues and service management standards (e.g., Information Technology Infrastructure Library, v3 [ITIL]). Applicable Skill in talking to others to convey information effectively. Applicable Knowledge of intelligence reporting principles, policies, procedures, and vehicles, including report formats, reportable criteria (requirements and priorities), dissemination practices, and legal authorities and restrictions. Applicable Knowledge of the organization's core business/mission processes. Applicable Knowledge of the structure and intent of business or military operation plans, concept operation plans, orders, policies, and standing rules of engagement. Applicable Knowledge of Privacy Impact Assessments (PIA). Applicable Skill in deconflicting cyber operations and activities. Applicable Arrives at sound conclusions and recommendations based on business goals data, and practical constraints. Applicable Considers alternatives, implements decisions, and evaluates their effectiveness. Applicable Demonstrates urgency and timeliness when dealing with critical issues or people. Applicable Identifies efficiency improvements Applicable Identifies problems and appreciates the issues required to resolve them Applicable Organizes resources effectively to meet demands of projects. Applicable Resolves issues quickly and effectively, in a way that mitigates repeat inquiries. Applicable Knowledge of organizational process improvement concepts and process maturity models (e.g., Capability Maturity Model Integration (CMMI) for Development, CMMI for Services and CMMI for Acquisitions). Applicable Actively identifies new areas for learning and regularly created and takes advantage of learning opportunities Applicable Acts courteously and professionally when dealing with customers. Applicable Consistently meets expected results within deadlines Applicable Follows-up to ensure satisfactory service and complete problem resolution. Applicable Gets all things done on a timely basis Applicable Is courteous and helpful when responding to requests, even if urgent or unplanned. Applicable Maintains composure during pressured/stressful situations. Applicable Maintains records as required for the project or service Applicable