Overview:
Position Description and Job Skill Set
Description of the job functions the contractor will be expected to perform.
The contractor will develop, revise, and maintain information security governance documentation. The work includes
creating technically accurate, enforceable documentation aligned with cybersecurity frameworks and organizational
objectives.
Primary responsibilities include:
- Develop and revise information security policies
- Develop technical standards supporting approved security policies.
- Develop operational procedures and implementation of guidance.
- Create security baselines and configuration documentation.
- Develop compliance documentation for technical accuracy, consistency, completeness, and enforceability.
- Recommend improvements to governance documentation structure and organization.
- Produce clear documentation suitable for technical staff, management, auditors, and external reviewers.
- Work with subject matter experts to accurately document existing processes and required controls.
- Maintain document version control and support periodic review.
Required Skills/Experience
Provide the minimum required skills and/or experience the contractor must possess to qualify for this position. These
requirements will be transferred to the Score Sheet and candidates without these requirements reflected on their resume will
NOT be presented to the manager for consideration.
Technical writing experience involving cybersecurity or IT governance.
Demonstrated experience with several of the following:
- NIST Cybersecurity Framework
- NIST SP 800-53
2
4. Scoring Method
Criteria Score Percentage Must equal 100%
Relevant Experience (Developing Polices, Standards, Procedures) 20
Technical Knowledge of Security Frameworks (NIST, Pub. 1075, CIS) 20
Quality of Writing 20
Qualifications (Education and Certifications) 15
Cost 25
- CIS Critical Security Controls
- Security governance and risk management
- Identity and Access Management
- Incident Response
- Vulnerability Management
- Disaster Recovery and Business Continuity
- Vendor Risk Management
- Security Awareness and Training
- Policy Lifecycle Management
Skills:
NIST, Pub. 1075, CIS
