Vulnerability Assessment Analyst

The Vulnerability Assessment Analyst performs assessments of systems and networks within the enterprise system infrastructure and identifies where those systems/networks deviate from acceptable configurations or pre-defined policies. They also measure the effectiveness of the defense-in-depth architecture against known vulnerabilities.

wdt_ID	SN	Code	Category	Responsibilities
1	1	T0010	Tasks	Analyze organization's cyber defense policies and configurations and evaluate compliance with regulations and organizational directives.
2	2	T0028	Tasks	Conduct and/or support authorized penetration testing on enterprise network assets.
3	3	T0138	Tasks	Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions.
4	4	T0142	Tasks	Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.
5	5	T0188	Tasks	Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions.
6	6	T0252	Tasks	Conduct required reviews as appropriate within environment (e.g., Technical Surveillance, Countermeasure Reviews [TSCM], TEMPEST countermeasure reviews).
7	7	T0549	Tasks	Perform technical (evaluation of technology) and nontechnical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications).
8	8	T0550	Tasks	Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).
9	9	K0001	Knowledge	Knowledge of computer networking concepts and protocols, and network security methodologies.
10	10	K0002	Knowledge	Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
11	11	K0003	Knowledge	Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
12	12	K0004	Knowledge	Knowledge of cybersecurity and privacy principles.
13	13	K0005	Knowledge	Knowledge of cyber threats and vulnerabilities.
14	14	K0006	Knowledge	Knowledge of specific operational impacts of cybersecurity lapses.
15	15	K0009	Knowledge	Knowledge of application vulnerabilities.
16	16	K0019	Knowledge	Knowledge of cryptography and cryptographic key management concepts
17	17	K0021	Knowledge	Knowledge of data backup and recovery.
18	18	K0033	Knowledge	Knowledge of host/network access control mechanisms (e.g., access control list, capabilities lists).
19	19	K0044	Knowledge	Knowledge of cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
20	20	K0056	Knowledge	Knowledge of network access, identity, and access management (e.g., public key infrastructure, Oauth, OpenID, SAML, SPML).
21	21	K0061	Knowledge	Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
22	22	K0068	Knowledge	Knowledge of programming language structures and logic.
23	23	K0070	Knowledge	Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
24	24	K0089	Knowledge	Knowledge of systems diagnostic tools and fault identification techniques.
25	25	K0106	Knowledge	Knowledge of what constitutes a network attack and a network attack’s relationship to both threats and vulnerabilities.
26	26	K0139	Knowledge	Knowledge of interpreted and compiled computer languages.
27	27	K0161	Knowledge	Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks).
28	28	K0162	Knowledge	Knowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored).
29	29	K0167	Knowledge	Knowledge of system administration, network, and operating system hardening techniques.
30	30	K0177	Knowledge	Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
31	31	K0179	Knowledge	Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
32	32	K0203	Knowledge	Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).
33	33	K0206	Knowledge	Knowledge of ethical hacking principles and techniques.
34	34	K0210	Knowledge	Knowledge of data backup and restoration concepts.
35	35	K0224	Knowledge	Knowledge of system administration concepts for operating systems such as but not limited to Unix/Linux, IOS, Android, and Windows operating systems.
36	36	K0265	Knowledge	Knowledge of infrastructure supporting information technology (IT) for safety, performance, and reliability.
37	37	K0287	Knowledge	Knowledge of an organization's information classification program and procedures for information compromise.
38	38	K0301	Knowledge	Knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
39	39	K0308	Knowledge	Knowledge of cryptology.
40	40	K0332	Knowledge	Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
41	41	K0342	Knowledge	Knowledge of penetration testing principles, tools, and techniques.
42	42	K0344	Knowledge	Knowledge of an organization’s threat environment.
43	43	K0624	Knowledge	Knowledge of Application Security Risks (e.g. Open Web Application Security Project Top 10 list)
44	44	S0001	Skills	Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
45	45	S0025	Skills	Skill in detecting host and network based intrusions via intrusion detection technologies (e.g., Snort).
46	46	S0044	Skills	Skill in mimicking threat behaviors.
47	47	S0051	Skills	Skill in the use of penetration testing tools and techniques.
48	48	S0052	Skills	Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.).
49	49	S0081	Skills	Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.).
50	50	S0120	Skills	Skill in reviewing logs to identify evidence of past intrusions.
51	51	S0137	Skills	Skill in conducting application vulnerability assessments.
52	52	S0171	Skills	Skill in performing impact/risk assessments.
53	53	S0364	Skills	Skill to develop insights about the context of an organization’s threat environment
54	54	S0367	Skills	Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
55	55	A0001	Abilities	Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.
56	56	A0044	Abilities	Ability to apply programming language structures (e.g., source code review) and logic.
57	57	A0120	Abilities	Ability to share meaningful insights about the context of an organization’s threat environment that improve its risk management posture.
58	58	A0123	Abilities	Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).