Information Security Officer 2

We need to output HTML fragment with sections: Overview? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. We need to decide which sections to include based on content. We have: - Overview: description of Draper (company). Could be "About the role"? Actually "Overview" is about the company, not role. Could be "About the role"? Might be better to have "About the role" for job description summary. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can include sections: About the role (job description summary), Responsibilities (duties/responsibilities), Skills/Abilities (maybe Skills), Education (maybe Qualifications), Experience (maybe Requirements), Security clearance (maybe Requirements), Pay (salary range), Benefits (work-life balance programs), Location (maybe not a heading but could be included in a paragraph). However we must only include sections when posting has real specific content. We have salary range: $82,300.00 - $220,000.00. That's specific, so Pay section is appropriate. Benefits: they mention work-life balance programs: workplace flexibility, employee clubs, health and finance workshops, off site social events, discounts to local museums and cultural activities. That's specific, so Benefits section. Schedule: not mentioned explicitly; no schedule info. So omit Schedule. Location: we have city, state, postal code. Could be included in a paragraph, not necessarily a heading. The instruction says do not create sections for minor metadata; we can put location in a

. We also have "Additional Job Description" about security clearance: "Applicants selected for this position will be required to obtain and maintain a government security clearance. An active TS//SCI with Polygraph is required." That's a requirement; could go under Requirements or Qualifications. We have "Education Requires a bachelor's degree in Information Technology or a related field. Equivalent industry experience may be substituted. Possesses an IAM I/IAT II Certification, or greater." That's qualifications. Experience: "3-5 years year relevant industry experience is required, Preferred experience with auditing systems using native language (PS/BASH), with tools and basic scripts / queries, and experience working with ISSMs to create and manage POA&Ms." Skills/Abilities: list of fundamentals. We also have "Job Description Summary" which is a paragraph about role. We need to avoid duplication: The "Duties/Responsibilities" section includes many bullet points; we should put those in

• . We also have "Skills/Abilities" list; we can put under Skills heading. We have "Education" and "Experience" could be under Qualifications or Requirements. The instruction suggests headings like Requirements, Qualifications, Skills. We can decide to have: - About the role (job description summary) - Responsibilities (duties/responsibilities) - Qualifications (education, certification, experience) - Skills (skills/abilities) - Pay (salary range) - Benefits (work-life balance) We might also include a short paragraph for location and maybe security clearance within Qualifications. We must not include boilerplate like EEO, etc. Remove those. We must preserve all substantive information: ensure we don't lose any details. Let's extract substantive content: Overview (company description) - maybe we can include as a brief paragraph before sections? The instruction says do not repeat job title as heading; but we can include a paragraph about company? It's not a heading; we could include it as a

  before sections. However the instruction says "Prefer a few substantive sections over many thin ones." Could include overview as a paragraph, not a heading. But we need to decide if we should include overview as a section. The allowed headings list does not include "Overview". Could we still use

  for Overview? The instruction says use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It gives examples but not exclusive list. It says "use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." This suggests we should use those headings; but we could also use other headings if needed? It says "use

  for section headings (e.g. ...)" meaning we should use h3 for any section headings, and the examples are typical ones. It doesn't forbid other headings, but to be safe we stick to those examples. So we should not create an "Overview" heading; we can incorporate overview info into a paragraph maybe under About the role? But About the role is supposed to be about the role, not company. However we could include company overview as part of About the role? Might be odd. Alternatively we could treat the overview as a brief introductory paragraph before any headings, not a heading. That seems acceptable: we output HTML fragment that can include

  before any

  . The instruction didn't forbid that. It said "use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." So we can have a leading paragraph. Thus we will output:

  Draper is an independent, nonprofit research and development company headquartered in Cambridge, MA. The 2,000+ employees of Draper tackle important national challenges with a promise of delivering successful and usable solutions. From military defense and space exploration to biomedical engineering, lives often depend on the solutions we provide. Our multidisciplinary teams of engineers and scientists work in a collaborative environment that inspires the cross-fertilization of ideas necessary for true innovation. For more information about Draper, visit www.draper.com.

  Then

  About the role

  with the Job Description Summary paragraph. Then

  Responsibilities

  with
  • list of duties. Then

    Qualifications

    with education, certification, experience, security clearance. Then

    Skills

    with skills/abilities list. Then

    Pay

    with salary range paragraph. Then

    Benefits

    with work-life balance programs list. We must not include Schedule. We must not include duplicated lines. We need to ensure we preserve all substantive information: Let's extract each piece. From the posting: Overview paragraph (company description) - we captured. Job Description Summary: "The Information System Security Officer 2 (ISSO) supports the continuous monitoring and authorization efforts of multiple classified information systems under the direction of the Information System Security Manager (ISSM). Performing a variety of technical, and non-technical Cyber Security functions. Responsibilities also include physical and environmental protection, personnel security, incident handling, and security training and awareness. In close coordination with the ISSM and ISO, the ISSO plays an active role in monitoring a system and its environment of operation to include developing and updating the SSP, managing and controlling changes to the system, and assessing the security impact of those changes." We need to keep that exactly. Duties/Responsibilities list: - Assist the ISSM in meeting their duties and responsibilities. - The ISSO shall assume ISSM responsibilities in the absence of the ISSM. - Ensure systems are operated, maintained, and disposed of in accordance with security policies and procedures as outlined in the security authorization package. - Attend required technical and security training (e.g., operating system, networking, security management) relative to assigned duties. - Ensure all users have the requisite security clearances, authorization, need-to-know, and are aware of their security responsibilities before granting access to the IS. - Conduct periodic reviews of information systems to ensure compliance with the security authorization package. - Coordinate any changes or modifications to hardware, software, or firmware of a system with the ISSM and AO/DAO prior to the change. - Formally notify the ISSM and AO/DAO when changes occur that might affect system authorization. - Monitor system recovery processes to ensure security features and procedures are properly restored and functioning correctly. - Ensure all IS security-related documentation is current and accessible to properly authorized individuals. - Conduct Audits and Continuous Monitoring (ConMon) activities using available technical and non-technical processes, reports Audit and ConMon findings, Execute incident response and attends and contributes to status meetings. - Manage configuration baselines of both hardware and software - Identify system architecture flaws using industry standard tools (e.g. STIG, SCAP, Nessus) that will be flowed to the ISSM for review. - Mentors and coaches ISSO 1. - Performs other duties as assigned. We need to keep each as
  • . Skills/Abilities list: - Fundamental understanding of common auditing techniques - Understanding of RMF (NIST SP 800-53, JSIG, DAAG, ICD 503), IR, Vulnerability Management, SCAP, STIG, and Security-Relevant Tools. - Understands Information Technology basics. - Awareness of network type designations (e.g. WAN, LAN) and associated infrastructure (e.g. Servers, switches, firewalls). Education: - Requires a bachelor's degree in Information Technology or a related field. - Equivalent industry experience may be substituted. - Possesses an IAM I/IAT II Certification, or greater. Experience: - 3-5 years year relevant industry experience is required, - Preferred experience with auditing systems using native language (PS/BASH), with tools and basic scripts / queries, and experience working with ISSMs to create and manage POA&Ms. Additional Job Description: Applicants selected for this position will be required to obtain and maintain a government security clearance. An active TS//SCI with Polygraph is required. Location: Job Location - City: Cambridge, Job Location - State: Massachusetts, Job Location - Postal Code: 02139-3563. Pay: The US base salary range for this full-time position is $82,300.00 - $220,000.00 ... plus explanation. Benefits: Our work is very important to us, but so is our life outside of work. Draper supports many programs to improve work-life balance including workplace flexibility, employee clubs ranging from photography to yoga, health and finance workshops, off site social events and discounts to local museums and cultural activities. We need to preserve all that. We must remove boilerplate: EEO statements, etc. Also remove "Connect With Draper for Future Opportunities!" etc. Also remove "If you don't find the right posting..." etc. Also remove "Please note that the compensation details listed in US role postings reflect the base salary only, and does not include bonuses or benefits." That's part of pay explanation but maybe we can keep it? It's substantive about compensation details; it's not boilerplate? It's a note about compensation. It might be considered part of pay details. The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that note as part of Pay section. Also remove "Union ranges will be in compliance with the collective bargaining agreement's approved rates by location and role." That's also part of pay