FISMA Security Analyst
for each section heading. Use - for lists. Use
for prose.
We need to preserve all substantive info, remove boilerplate like cookie/navigation/legal/EEO etc. There's none. Also remove duplicated lines. Ensure we don't include placeholders.
We need to include sections: About the role (the introductory paragraph). Responsibilities (the list under "Requirements" actually describes responsibilities). Requirements (maybe the list of required skills? Actually they have "Required Skills:" and "Preferred Skills:" and "Education and Experience:" and "Physical Requirements:" Could treat "Requirements" as the list of activities? But they already used "Requirements" heading in the posting for activities. We need to follow instruction: use headings for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content accordingly.
We have:
- About the role: first paragraph describing purpose.
- Responsibilities: the list of activities under "Requirements The FISMA Security Analyst shall perform the following (to include but not limited to) activities:" That's responsibilities.
- Requirements: maybe the "Required Skills:" list? Or the education/experience? Usually Requirements could be required skills and qualifications. But we also have Qualifications section maybe for education/experience. Skills section for required and preferred skills. Benefits we have.
We need to avoid thin sections. Let's decide:
- About the role: paragraph.
- Responsibilities: ul of activities.
- Qualifications: Education and Experience + Physical Requirements? Could combine.
- Skills: Required Skills and Preferred Skills.
- Benefits: list.
We should not include Requirements as separate if we use Qualifications for education/experience and Skills for skills. But we need to follow instruction: include a section ONLY when posting has real specific content. We can have both Requirements and Qualifications if content distinct. However we have "Required Skills:" and "Preferred Skills:" which could go under Skills. The "Education and Experience:" and "Physical Requirements:" could go under Qualifications.
We could also have a Requirements section for the "Minimum 3-5 years direct experience..." etc. That's more like qualifications. So maybe:
- About the role
- Responsibilities
- Qualifications (Education & Experience, Physical Requirements)
- Skills (Required Skills, Preferred Skills)
- Benefits
We should not include Requirements separate to avoid duplication. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. It doesn't forbid omitting some. So we can omit Requirements if we think its content is covered elsewhere. But we have a "Requirements" heading in the original; but we need to map to our headings. Could treat the activities list as Responsibilities, and the "Required Skills:" etc as Requirements? Actually typical job postings: Responsibilities (duties), Requirements (qualifications/skills), Benefits. But they also have Qualifications separate. However we can follow typical: Responsibilities = activities list. Requirements = Required Skills + Education & Experience + Physical Requirements? Qualifications maybe not needed. But we need to decide.
Given the instruction: "Prefer a few substantive sections over many thin ones." So we should combine where possible.
Thus we could have:
- About the role
- Responsibilities
- Requirements (includes Required Skills, Preferred Skills, Education and Experience, Physical Requirements)
- Benefits
That's four sections.
But we need to use headings exactly as given: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. If we omit Qualifications and Skills, we are not using those headings; that's okay as per instruction: include a section ONLY when posting has real specific content. So we can omit Qualifications and Skills if we fold their content into Requirements. However we might lose distinction between skills and qualifications. But it's okay.
Alternatively we could keep Requirements for the activities list, Qualifications for education/experience, Skills for required/preferred skills. That would be three sections plus About the role and Benefits = five sections. That's still few.
Let's see content:
- Activities list (under "Requirements The FISMA Security Analyst shall perform the following...") => Responsibilities.
- Required Skills list => Skills (maybe Required Skills). Preferred Skills also under Skills.
- Education and Experience + Physical Requirements => Qualifications.
Thus we have:
About the role (p)
Responsibilities (ul)
Qualifications (ul? maybe combine education/experience and physical requirements as separate uls or p)
Skills (ul for required skills, ul for preferred skills)
Benefits (ul)
That seems reasonable and uses headings: About the role, Responsibilities, Qualifications, Skills, Benefits.
We must not include Pay or Schedule.
Now we need to preserve all substantive info. Let's extract.
About the role paragraph: "SES is seeking a SME FISMA Security Analyst to support the federal compliance and governance requirements for all systems supported by the Task Order. The purpose of this role is to assist the XGen DIGIT Director of Enterprise Security in the management and execution of GSA IT Enterprise Security Management and IT Continuity Management Services. The team is comprised of the best-in-class technology partners to leverage forward-leaning technologies and best practices to transform GSA's IT capabilities and shift offerings to provide a more flexible service delivery model, completing the agency's shift to a fully digital experience along with its adoption of advanced, emerging technologies such as intelligent automation, artificial intelligence, and machine learning."
That's the prose.
Responsibilities list: each bullet after "Provides technical support..." etc. Let's list them:
- Provides technical support to divisions and branches developing security architecture and supporting design and implementation of information technology security systems
- Supports research of new security products and services and supports the rollout of enterprise security solutions that leverage single Department-wide license agreements with new or existing vendors and service providers
- Leads developing, implementing, and maintaining enterprise-wide information security capabilities
- Analyzes the enterprise business models and IT systems to determine security risks and risk management considerations
- Defines enterprise- and system-level security requirements
- Supports the implementation and assessment of security and privacy controls in accordance with NIST SP 800-53 Revision 5 and applicable federal control baselines
- Supports the execution of the NIST Risk Management Framework (RMF) lifecycle, including control implementation, assessment, authorization, and continuous monitoring
- Assists with the development, review, and maintenance of RMF and FISMA documentation, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, risk assessments, control implementation statements, procedures, related governance documentation and authorization packages
- Proposes technical solutions for systems and application-level security architecture and design to reduce risk and support compliance objectives
- Supports continuous monitoring activities, including vulnerability management, control assessments, risk tracking, remediation validation, and reporting to stakeholders
- Assesses cybersecurity risks associated with APIs, integrations, data exchanges, and automated workflows, including authentication, authorization, encryption, logging, monitoring, and data protection considerations
- Supports API security risk management by reviewing API design and implementation for compliance with security requirements, secure configuration, access controls, token management, and protection of sensitive data
- Supports Robotic Process Automation risk management by assessing bots, workflows, service accounts, credential management, privilege assignments, logging, exception handling, and operational resilience
- Identifies and documents security risks related to intelligent automation, RPA, API integrations, and emerging technologies, and recommends mitigation strategies aligned with enterprise risk tolerance
That's all.
Qualifications: Education and Experience + Physical Requirements.
Education and Experience bullet points:
- 10 - 15 years of experience and bachelor's degree or equivalent
- Minimum 3-5 years direct experience with supporting FISMA and Financial Audit Requirements
- Minimum 3-5 years of direct experience supporting cybersecurity compliance and implementing steps to mitigate threats
- Minimum 3-5 years direct experience with continuous monitoring security expertise to business units and key stakeholders
- Minimum 3-5 years of direct experience creating and delivering end user-related briefings, training, policy, and/or compliance updates
- Experience as a remote worker demonstrating time management and self-discipline with cultural change management and Agile mindset
Physical Requirements bullet points (the list under "While performing the duties of this job, the employee is regularly required to do the following:" includes multiple items):
- If remote, maintain home workspace in a safe manner, free from safety hazards and in line with information security policies.
- Communicate verbally in person, over the phone or by video chat and clearly/succinctly in writing, primarily utilizing a keyboard.
- Appear on camera for meetings with co-workers and government partners via video chat and ensure the protection of proprietary company and customer information is consistent with the company's expectation of information security
- Viewing computer screens and sitting for long periods of time.
- Travel is not required.
We could combine these as a list under Qualifications.
Skills: Required Skills and Preferred Skills.
Required Skills bullet points:
- Ability to obtain a Public Trust Clearance and ITILv4 Foundation Certification
- Possesses and applies a comprehensive knowledge across key tasks and high impact assignments
- Functions as a security expert across multiple project assignments. Proven ability to work independently in a full and/or partial remote environment with limited supervision and may supervise/lead others
- Possess the ability to communicate in both oral and written forms, demonstrating an ability to communicate effectively with all levels of staff as well as clients
- Maintain standard working hours per the DIGIT contract and to be available for meetings, and other collaborative efforts during working hours
- Demonstrated ability to apply comprehensive knowledge across key tasks and high impact assignments with the ability to use practical experience and training to determine how to accomplish tasks
Preferred Skills bullet points:
- CISSP, CISA, CISM, Security+ or other relevant security certifications
- Familiarity with CUI requirements for unclassified IT systems a plus
- Must have track record of competency in obtaining initial A&A and reauthorization
- Familiarity with Unclassified network administration, specifically with:
- Network infrastructure and security best practices
- Local Area Network administration and maintenance, including user control and VPN access
- Firewalls
- Mobile Device Management
- Identity and Authentication Services Management
- Comfortable with Windows operating systems
- Willingness and ability to independently take on a variety of IT Compliance tasks
- Linux operating systems experience
- Familiarity in the Google Suite (Gmail, Calendar, Chat, Meet, Docs, Slides, Sheets), Microsoft Office (Word, Excel, PowerPoint, Outlook) and ServiceNow
Note: The "Preferred Skills" includes a sublist. We need to preserve that structure. Could output as nested ul? The instruction: Use
- for any list of duties/requirements/benefits. For sublist we could still use ul li inside li? Might be okay. We'll keep as ul li with sub-ul.
Benefits list:
- Medical
- Dental
- Vision
- AD&D
- STD
- LTD
- Company paid Life Insurance
- 401k with employer contribution
- Paid Time Off
- Pet Insurance
Also "competitive salary" mentioned but no specific number; we should not create Pay section because no specific salary. So we can mention competitive salary in Benefits? It's not a benefit but a statement. Could include in Benefits paragraph? The instruction: never create Pay/Schedule/Benefits sections unless posting actually states them. Benefits section is present; we can include the competitive salary as part of Benefits paragraph maybe as a
before list. But we should not invent. The posting says
for prose. We need to preserve all substantive info, remove boilerplate like cookie/navigation/legal/EEO etc. There's none. Also remove duplicated lines. Ensure we don't include placeholders. We need to include sections: About the role (the introductory paragraph). Responsibilities (the list under "Requirements" actually describes responsibilities). Requirements (maybe the list of required skills? Actually they have "Required Skills:" and "Preferred Skills:" and "Education and Experience:" and "Physical Requirements:" Could treat "Requirements" as the list of activities? But they already used "Requirements" heading in the posting for activities. We need to follow instruction: use headings for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content accordingly. We have: - About the role: first paragraph describing purpose. - Responsibilities: the list of activities under "Requirements The FISMA Security Analyst shall perform the following (to include but not limited to) activities:" That's responsibilities. - Requirements: maybe the "Required Skills:" list? Or the education/experience? Usually Requirements could be required skills and qualifications. But we also have Qualifications section maybe for education/experience. Skills section for required and preferred skills. Benefits we have. We need to avoid thin sections. Let's decide: - About the role: paragraph. - Responsibilities: ul of activities. - Qualifications: Education and Experience + Physical Requirements? Could combine. - Skills: Required Skills and Preferred Skills. - Benefits: list. We should not include Requirements as separate if we use Qualifications for education/experience and Skills for skills. But we need to follow instruction: include a section ONLY when posting has real specific content. We can have both Requirements and Qualifications if content distinct. However we have "Required Skills:" and "Preferred Skills:" which could go under Skills. The "Education and Experience:" and "Physical Requirements:" could go under Qualifications. We could also have a Requirements section for the "Minimum 3-5 years direct experience..." etc. That's more like qualifications. So maybe: - About the role - Responsibilities - Qualifications (Education & Experience, Physical Requirements) - Skills (Required Skills, Preferred Skills) - Benefits We should not include Requirements separate to avoid duplication. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. It doesn't forbid omitting some. So we can omit Requirements if we think its content is covered elsewhere. But we have a "Requirements" heading in the original; but we need to map to our headings. Could treat the activities list as Responsibilities, and the "Required Skills:" etc as Requirements? Actually typical job postings: Responsibilities (duties), Requirements (qualifications/skills), Benefits. But they also have Qualifications separate. However we can follow typical: Responsibilities = activities list. Requirements = Required Skills + Education & Experience + Physical Requirements? Qualifications maybe not needed. But we need to decide. Given the instruction: "Prefer a few substantive sections over many thin ones." So we should combine where possible. Thus we could have: - About the role - Responsibilities - Requirements (includes Required Skills, Preferred Skills, Education and Experience, Physical Requirements) - Benefits That's four sections. But we need to use headings exactly as given: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. If we omit Qualifications and Skills, we are not using those headings; that's okay as per instruction: include a section ONLY when posting has real specific content. So we can omit Qualifications and Skills if we fold their content into Requirements. However we might lose distinction between skills and qualifications. But it's okay. Alternatively we could keep Requirements for the activities list, Qualifications for education/experience, Skills for required/preferred skills. That would be three sections plus About the role and Benefits = five sections. That's still few. Let's see content: - Activities list (under "Requirements The FISMA Security Analyst shall perform the following...") => Responsibilities. - Required Skills list => Skills (maybe Required Skills). Preferred Skills also under Skills. - Education and Experience + Physical Requirements => Qualifications. Thus we have: About the role (p) Responsibilities (ul) Qualifications (ul? maybe combine education/experience and physical requirements as separate uls or p) Skills (ul for required skills, ul for preferred skills) Benefits (ul) That seems reasonable and uses headings: About the role, Responsibilities, Qualifications, Skills, Benefits. We must not include Pay or Schedule. Now we need to preserve all substantive info. Let's extract. About the role paragraph: "SES is seeking a SME FISMA Security Analyst to support the federal compliance and governance requirements for all systems supported by the Task Order. The purpose of this role is to assist the XGen DIGIT Director of Enterprise Security in the management and execution of GSA IT Enterprise Security Management and IT Continuity Management Services. The team is comprised of the best-in-class technology partners to leverage forward-leaning technologies and best practices to transform GSA's IT capabilities and shift offerings to provide a more flexible service delivery model, completing the agency's shift to a fully digital experience along with its adoption of advanced, emerging technologies such as intelligent automation, artificial intelligence, and machine learning." That's the prose. Responsibilities list: each bullet after "Provides technical support..." etc. Let's list them: - Provides technical support to divisions and branches developing security architecture and supporting design and implementation of information technology security systems - Supports research of new security products and services and supports the rollout of enterprise security solutions that leverage single Department-wide license agreements with new or existing vendors and service providers - Leads developing, implementing, and maintaining enterprise-wide information security capabilities - Analyzes the enterprise business models and IT systems to determine security risks and risk management considerations - Defines enterprise- and system-level security requirements - Supports the implementation and assessment of security and privacy controls in accordance with NIST SP 800-53 Revision 5 and applicable federal control baselines - Supports the execution of the NIST Risk Management Framework (RMF) lifecycle, including control implementation, assessment, authorization, and continuous monitoring - Assists with the development, review, and maintenance of RMF and FISMA documentation, including System Security Plans, Security Assessment Reports, Plans of Action and Milestones, risk assessments, control implementation statements, procedures, related governance documentation and authorization packages - Proposes technical solutions for systems and application-level security architecture and design to reduce risk and support compliance objectives - Supports continuous monitoring activities, including vulnerability management, control assessments, risk tracking, remediation validation, and reporting to stakeholders - Assesses cybersecurity risks associated with APIs, integrations, data exchanges, and automated workflows, including authentication, authorization, encryption, logging, monitoring, and data protection considerations - Supports API security risk management by reviewing API design and implementation for compliance with security requirements, secure configuration, access controls, token management, and protection of sensitive data - Supports Robotic Process Automation risk management by assessing bots, workflows, service accounts, credential management, privilege assignments, logging, exception handling, and operational resilience - Identifies and documents security risks related to intelligent automation, RPA, API integrations, and emerging technologies, and recommends mitigation strategies aligned with enterprise risk tolerance That's all. Qualifications: Education and Experience + Physical Requirements. Education and Experience bullet points: - 10 - 15 years of experience and bachelor's degree or equivalent - Minimum 3-5 years direct experience with supporting FISMA and Financial Audit Requirements - Minimum 3-5 years of direct experience supporting cybersecurity compliance and implementing steps to mitigate threats - Minimum 3-5 years direct experience with continuous monitoring security expertise to business units and key stakeholders - Minimum 3-5 years of direct experience creating and delivering end user-related briefings, training, policy, and/or compliance updates - Experience as a remote worker demonstrating time management and self-discipline with cultural change management and Agile mindset Physical Requirements bullet points (the list under "While performing the duties of this job, the employee is regularly required to do the following:" includes multiple items): - If remote, maintain home workspace in a safe manner, free from safety hazards and in line with information security policies. - Communicate verbally in person, over the phone or by video chat and clearly/succinctly in writing, primarily utilizing a keyboard. - Appear on camera for meetings with co-workers and government partners via video chat and ensure the protection of proprietary company and customer information is consistent with the company's expectation of information security - Viewing computer screens and sitting for long periods of time. - Travel is not required. We could combine these as a list under Qualifications. Skills: Required Skills and Preferred Skills. Required Skills bullet points: - Ability to obtain a Public Trust Clearance and ITILv4 Foundation Certification - Possesses and applies a comprehensive knowledge across key tasks and high impact assignments - Functions as a security expert across multiple project assignments. Proven ability to work independently in a full and/or partial remote environment with limited supervision and may supervise/lead others - Possess the ability to communicate in both oral and written forms, demonstrating an ability to communicate effectively with all levels of staff as well as clients - Maintain standard working hours per the DIGIT contract and to be available for meetings, and other collaborative efforts during working hours - Demonstrated ability to apply comprehensive knowledge across key tasks and high impact assignments with the ability to use practical experience and training to determine how to accomplish tasks Preferred Skills bullet points: - CISSP, CISA, CISM, Security+ or other relevant security certifications - Familiarity with CUI requirements for unclassified IT systems a plus - Must have track record of competency in obtaining initial A&A and reauthorization - Familiarity with Unclassified network administration, specifically with: - Network infrastructure and security best practices - Local Area Network administration and maintenance, including user control and VPN access - Firewalls - Mobile Device Management - Identity and Authentication Services Management - Comfortable with Windows operating systems - Willingness and ability to independently take on a variety of IT Compliance tasks - Linux operating systems experience - Familiarity in the Google Suite (Gmail, Calendar, Chat, Meet, Docs, Slides, Sheets), Microsoft Office (Word, Excel, PowerPoint, Outlook) and ServiceNow Note: The "Preferred Skills" includes a sublist. We need to preserve that structure. Could output as nested ul? The instruction: Use
- for any list of duties/requirements/benefits. For sublist we could still use ul li inside li? Might be okay. We'll keep as ul li with sub-ul.
Benefits list:
- Medical
- Dental
- Vision
- AD&D
- STD
- LTD
- Company paid Life Insurance
- 401k with employer contribution
- Paid Time Off
- Pet Insurance
Also "competitive salary" mentioned but no specific number; we should not create Pay section because no specific salary. So we can mention competitive salary in Benefits? It's not a benefit but a statement. Could include in Benefits paragraph? The instruction: never create Pay/Schedule/Benefits sections unless posting actually states them. Benefits section is present; we can include the competitive salary as part of Benefits paragraph maybe as a
before list. But we should not invent. The posting says