NIST SP 800-137

Department:Department Of Transportation

Agency:Federal Aviation Administration

The Next Generation of Flight is Underway – and you can be part of it! We need you and your fresh ideas to shape the air transportation system of tomorrow, and the way America flies. Come be a part of the new generation in aviation, an industry that is absolutely critical to this nation’s economy and security.
The Next Generation Air Transportation System (NextGen) is a fundamental transformation of our nation’s airspace system. It uses 21st century technologies to meet future demands, avoid gridlock in the sky and on the runways, further improve safety, and protect the environment. For more information on NextGen, watch this brief introduction : NextGen Introduction
About the FAA         Employment Information

Business Component: Office of Information Services and Chief Information Officer, AIO-1; Office of Information Systems Security, AIS-1, Certification and Compliance Division, AIS-300.
Sample of Duties: The incumbent develops and manages the Agency’s Information Security Continuous Monitoring (ISCM) and Risk Scoring Requirement, Strategic, and Capability plans…. (see Duties tab for more duties)

Additional Salary Information: Salary includes the 24.22% locality pay for the Washington, DC Metropolitan area.
No Permanent Change of Station (PCS) payments are authorized.

The incumbent develops and manages the Agency’s Information Security Continuous Monitoring (ISCM) and Risk Scoring Requirement, Strategic, and Capability plans. Identifies and analyzes required automated data feeds and develops processes for submission to the Department of Transportation (DOT) for eventual entry into Department of Homeland Security (DHS) Cyberscope in support of Federal Information Security Management Act (FISMA) Reporting. Conducts research, tests, and makes recommendations for supplemental ISCM automation capabilities. Develops and manages the process for applying ISCM to the System Authorization Process for Agency information systems. Reviews Security Authorization documentation against National Institute of Standards and Technology (NIST) Special Publications (SP) and the FAA System Authorization Handbook and provides feedback to the originating office and the Chief Information Security Officer (CISO). Interprets Department of Transportation (DOT) Office of the Inspector General (OIG) and General Accountability Office (GAO) audit findings and generates responses to the applicable agency. Develops Agency Cloud security strategies and plans based on the Federal Risk and Authorization Management Program (FedRamp) and other applicable federal guidance.

All applicants must demonstrate one year of SPECIALIZED experience equivalent to the next lower grade (FG/GS-14) or pay band level (FV-J) in the Federal Service. SPECIALIZED experience is defined as experience which is in or related to the line of work of the position to be filled and has equipped the applicant with the particular knowledge, skills and abilities to successfully perform the duties of the position. Examples of specialized experience for this position includes but not limited to, experience developing Information Security Continuous Monitoring (ISCM) and Risk Scoring requirement, strategic, and capability plans and processes.

In addition to the minimum qualifications, the following has been determined to be a selective factor for this position. This means possession of this criterion is part of the minimum qualifications and is essential to perform the duties and responsibilities of this position. Applicants who do not possess this criterion are ineligible for further consideration.

• SELECTIVE PLACEMENT FACTOR: Demonstrated experience developing Information Security Continuous Monitoring (ISCM) and Risk Scoring requirement, strategic, and capability plans and processes, including identifying required data feeds; researching automated Information Security Continuous Monitoring (ISCM) capabilities; developing reporting architectures, and dashboards based on Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) guidance and requirements.

We are not accepting applications from noncitizens.

IMPORTANT: Ensure that your work experience supports your Knowledge, Skills and Abilities (KSA) answers. Your answers and associated work experience will be evaluated further to validate whether the answers that you selected are appropriate. Answers may be adjusted by a Human Resource Specialist as appropriate.

HOW YOU WILL BE EVALUATED:

Applicants may be rated on the extent and quality of experience, education, and training relevant to the duties of the position(s). All answers provided in the on-line process must be substantiated.

Knowledge, Skills and Abilities (KSA)

1. SELECTIVE PLACEMENT FACTOR: Demonstrated experience developing Information Security Continuous Monitoring (ISCM) and Risk Scoring requirement, strategic, and capability plans and processes, including identifying required data feeds; researching automated Information Security Continuous Monitoring (ISCM) capabilities; developing reporting architectures, and dashboards based on Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) guidance and requirements.

2. Demonstrated experience in Security Content Application Protocol (SCAP)format/specifications/schema and SCAP automation tools as it relates to Asset Management; Configuration Management; United States Government Configuration Baseline (USGCB); and Secure Baseline Configuration (SBC). Vulnerability Management data feeds; Common configuration Enumeration (CCE); Common Platform Enumeration (CPE); and Common Vulnerability Exposure (CVE) in support of Information Security Continuous Monitoring (ISCM) and FISMA Reporting.

3. Experience with Cloud security and Federal Risk and Authorization Management Program (FedRamp) requirements.

4. Demonstrated skill in managing technical work groups and projects to solve complex policy and technical issues.

5. Demonstrated skill in evaluating compliance with established ISS policy and federal laws, including the Federal Information Security Management Act (FISMA); Interpreting audit findings from (DOT Chief Information Officer (CIO), Government Accountability Office (GAO), DOT Office of the Inspector General (OIG); and coordinating and generating audit responses to the applicable agency, (i.e., FISMA CIO Metrics).

FAA offers an excellent comprehensive benefits programs. To learn more about the federal government benefits, please click here.

OTHER INFORMATION:

We may use this vacancy to fill other similar vacant positions. Travel may be required. Position may be subject to a background investigation. A one-year probationary period may be required.

1) In the text box following each Knowledge, Skills and Abilities (KSA), please provide a brief explanation of your possession of the applicable KSA,. Include the name, title, organization name, and phone number of at least one reference that can be contacted for further verification of your level of capability.

2) ALL APPLICANTS MUST PROVIDE A NARRATIVE RESPONSE TO THE SELECTIVE PLACEMENT FACTOR. Applicants who fail to provide a narrative response to the SELECTIVE FACTOR will not receive further consideration for this vacancy. Note: “See Resume” does not constitute a sufficient narrative response.

3) Applicants must apply on-line via (https://jobs.faa.gov) for employment consideration. Applications must have a status of Submitted before 12:00 AM (midnight) EST on the closing date of the vacancy announcement for it to be accepted. Applications submitted via email or fax WILL NOT be considered.

4) Leave Enhancement: FAA organizations may offer enhanced annual leave accrual to certain newly appointed or reappointed employees. In order to receive consideration for such benefit, applicants’ prior non-Federal service or active duty uniformed service must directly relate to the duties of the position to which appointed. Granting enhanced annual leave accrual is at the sole discretion of the hiring organization, and granting such benefit is not an entitlement or a guarantee.

5) Financial Disclosure: The person selected for this position may be required to file a financial disclosure statement within 30 days of entry on duty. FAA policy limits certain outside employment and financial investments in aviation-related companies.

6) Some, all, or none of the referred candidates may be interviewed.

7) This announcement may be used to fill other similar positions.

8) This position may be eligible to participate in the FAA Telework program.

9) This position is also being announced under Vacancy Announcement No. AWA-AIO-12-MR47065-27086 as Current or Former Federal Employees & EVHO. Please review both vacancy announcements to determine if you are eligible to apply.

This is not a bargaining unit position.

Links to Important Information: Locality Pay, COLA, Citizenship, Financial Disclosure

You must apply online to receive consideration. Your application must have a status of “Submitted” by 11:59 PM Eastern Time on the Close Date for it to be accepted. If you are applying for positions associated with FAA registers, your application must have a status of “Submitted” each time a referral list is created in order to receive consideration for positions associated with register.

IN DESCRIBING YOUR WORK EXPERIENCE AND/OR EDUCATION, PLEASE BE CLEAR AND SPECIFIC REGARDING YOUR EXPERIENCE OR EDUCATION.

We strongly encourage applicants to utilize the USAJOBS resume builder in the creation of resumes.

Please ensure EACH work history includes ALL of the following information:

• Job Title (include series and grade if Federal Job)
• Duties (be specific in describing your duties)
• Employer’s name and address
• Supervisor name and phone number
• Start and end dates including month and year (e.g. June 2007 to April 2008)
• Full-time or part-time status (include hours worked per week)
• Salary

Determining length of General or Specialized Experience is dependent on the above information and failure to provide ALL of this information may result in a finding of ineligible.

You may upload completed documents to your USAJOBS Account. This will provide you the opportunity to utilize the uploaded information again when applying for future vacancies. Please see this guide,

Document Upload Guide

, for more information on uploading and re-using the documents in your applications.

REQUIRED DOCUMENTS:

Applicants, with exception of current, permanent FAA employees, must provide a copy of their most recent SF-50 (Notification of Personnel Action) that verifies the position title, series, grade, and tenure. The document must be uploaded to the online application or faxed to (202) 267-7032 OR 1-866-291-3009, and referenced the vacancy announcement number on the cover letter of the faxed documents.

AGENCY CONTACT INFO: