Category Archives: roles

IT security position job Q&A (part 1)

cyberspace workforce, DIACAP, DIARMF Jobs, information system compliance, IT Certifications, IT Security Jobs, Risk Management For DoD IT, roles, , , , , ,

Check out my FREE courses at: https://securitycompliance.thinkific.com

In this video we read some of your questions about getting IT Security Jobs.

masaki23joe
“I have a B.A in Telecommunications, would this work for this career field.” see the answer at 00:00:45

shawn 08
“Hey Bruce I got my security + and cap. What do you suggest on how to get into the risk management/ security auditing field when someone doesn’t have any experience? I do have 7 years experience in desktop support and data center monitoring just want to try a different field but not sure how to go about this.”
answer at 00:02:53

David petrell
“What training is need to get into the security field? I have a BS in information security and working a MS in Cybersecurity and working on getting my CEH cert. What are ways that I can get into the security field as I don’t have any security experience and most jobs postings are wanting at least 4 to 5 years of experience”
answer at 00:06:26

Security Roles and Responsibilities

cyberspace workforce, DIARMF Jobs, risk jobs, Risk Management For DoD IT, roles, , , ,

There are hundreds of different roles & responsibilities in the IT Security career field alone. Here are some of the common types that I have seen:

Information System Security Manager – coordinate with the system owner and the information system security officer to ensure security is on the systems.
Information System Security Officer – coordinate with management and system administrators to implement system security controls. Ensures security controls are tracked and documented.
System Administrator – applies technical functionality and security on information systems.
Architect – assists in the design of enterprise information systems.
Security Analyst – review the logs of information systems to determine if there are any malicious activities happening.
Auditors – review the information systems to make sure the security controls are applied, documented and continuously monitored.

IT Security Career Risk Management Framework

cyberspace workforce, DIARMF, Information Assurance, NIST Security Framework, risk jobs, roles,

So you want to get into Information Technology? Well what do you want to do in IT because there are many different branches of it. I would suggest going into IT security, specifically, Risk Management Framework. It is a very specialized field.

You will need to know the fundamental of IT security. The basics on what goes into securing important data and their hardware. You will also need to have at least a little knowledge of technology and its history. You will need to know a LOT about NIST SP 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems”. You will need to dive into NIST SP 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations”.

Since not many people want to do this work, or even know about it, there is not much competition. They are always looking for qualified people to do it. What you will need is a 4 year degree (preferably in something technical), an IT certification in security (Security+, ISC2 CAP, CISSP, CASP, CISM,CISA) and a lot of knowledge on NIST 800-37.

 

dodd 8140 cyberspace workforce management

cyberspace workforce, NIST Security Framework, risk management, Risk Management For DoD IT, roles, , , , , , , , , ,

What is the DoD Directive 8140?
DoD 8140, Cyberspace workforce will supersede DoD 8570 as the guide for selecting the personnel with the correct certifications, skills and experience.

Where is the DoDD 8140.01, Cyberworkforce going?
8140 manual may mirror an ongoing initiative that has a lot more categories. Those high level categories would be under a National Initiative for Cybersecurity Education (NICE) framework:

Security Provision, Maintain and Operate, Protect & Defend, Analyze, operate & collect, Oversight & Development and Investigate.

These categories are broken down further into a sum total of 31 tasks. It was supposed to be released in 2013, but there is actually no telling when it will come out.

http://diarmfs.com
niccs.us-cert.gov

USCYBERCOM_NICE_roles

USCYBERCOM, National Initiative for Cyberspace Education (NICE)

cyberspace workforce, roles, , , , ,

DoD is using National Initiative for Cyberspace Education (NICE) to point their cyber security professionals in the right direction for training resources.  I wonder if this might hint at a DoDD 8140, Cyberwork force being inline with National Initiative for Cyberspace Education (NICE) National Cybersecurity Workforce Framework.

DISA has gathered inputs from USCYBERCOM, National Initiative for Cyberspace Education (NICE) and other partners to provide a catalog of training resources that are categorized by Cybersecurity work roles. The identified training resources will help DoD employees fulfill their knowledge or skill gaps and move from entry to advanced levels of proficiency in their assigned work roles. To learn more, and to view the training resources, please visit the Cybersecurity Role-Based Training Portal.

https://disa.deps.mil/ext/cop/iase/specialty_courses/ (DoD PKI Cert Required)

USCYBERCOM_NICE_roles
USCYBERCOM_NICE_roles
Information Assurance

Who has the authority to appoint an IAM (ISSM)

cyberspace workforce, DIARMF Jobs, Information Assurance, information assurance degree online, Information Assurance Jobs, Risk Management For DoD IT, roles,

Who has the authority to appoint an Information Assurance Manager (IAM)/Information Security Security Manager?

An IAM (Information Assurance Manager) is now called an Information System Security Manager (ISSM).  The program manager, system manager or component commanders appoints the Information security security manager in writing.

According to DoD 8510.01, Risk Management Framework it is the Program Manager/System Manager who appoints the ISSM for each assigned Information System or PIT system with the support, authority, and resources to satisfy the responsibilities established in this instruction.

In the Department of Navy, Information System Security Manager is appointed by Program Executive Offices, Systems Commands – According to SECNAV, 5239.2

The Army currently uses AR 25-2, Information Assurance (being replaced).  The Information Assurance Program Manager (IAPM) appoints the IAM 3-2.

IAM. Appoint IAMs at all appropriate levels of command. This includes subordinate commands, posts, installations, and tactical units. Appoint an IAM as needed for those Army activities responsible for project development, deployment, and management of command-acquired software, operating systems, and networks. A contractor will not fill the MSC, installation, or post IAM positions and the person filling the position will be a U.S. citizen.