Skip to content

Cybersecurity · Work role code 631

Information Systems Security Developer

Designs, develops, tests, and evaluates information system security throughout the systems development lifecycle.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 416Analyze design constraints, analyze trade-offs and detailed system and security design, and consider lifecycle support.Core
  • 419Apply security policies to applications that interface with one another, such as Business-to-Business (B2B) applications.Core
  • 425Assess the effectiveness of cybersecurity measures utilized by system(s).Core
  • 426Assess threats to and vulnerabilities of computer system(s) to develop a security risk profile.Core
  • 431Build, test, and modify product prototypes using working models or theoretical models.Core
  • 457Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).Core
  • 494Design and develop cybersecurity or cybersecurity-enabled products.Core
  • 496ADesign, develop, integrate, and update system security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.Core
  • 501Design or integrate appropriate data backup capabilities into overall system designs, and ensure appropriate technical and procedural processes exist for secure system backups and protected storage of backup data.Core
  • 503ADesign to security requirements to ensure requirements are met for all systems and/or applications.Core
  • 516Develop and direct system testing and validation procedures and documentation.Core
  • 530Develop detailed security design documentation for component and interface specifications to support system design and development.Core
  • 531Develop Disaster Recovery and Continuity of Operations plans for systems under development and ensure testing prior to systems entering a production environment.Core
  • 542ADevelop mitigation strategies to address cost, schedule, performance, and security risks.Additional
  • 626Identify components or elements, allocate security functions to those elements, and describe the relationships between the elements.Additional
  • 630Identify and direct the remediation of technical problems encountered during testing and implementation of new systems (e.g., identify and find work-arounds for communication protocols that are not interoperable).Core
  • 632Identify and prioritize essential system functions or sub-systems required to support essential capabilities or business functions for restoration or recovery after a system failure or during a system recovery event based on overall system requirements for continuity and availability.Additional
  • 648Identify, assess, and recommend cybersecurity or cybersecurity-enabled products for use within a system and ensure recommended products are in compliance with organization's evaluation and validation requirements.Additional
  • 659Implement security designs for new or existing system(s).Core
  • 662Incorporate cybersecurity vulnerability solutions into system designs (e.g., Cybersecurity Vulnerability Alerts).Core
  • 710Monitor and evaluate a system's compliance with information technology (IT) security, resilience, and dependability requirements.Additional
  • 737BPerform an information security risk assessment.Core
  • 766APerform security reviews and identify security gaps in architecture.Core
  • 770Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.Core
  • 803Provide guidelines for implementing developed systems to customers or installation teams.Additional
  • 808AProvide input to implementation plans and standard operating procedures as they relate to information systems security.Additional
  • 809Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).Core
  • 850Store, retrieve, and manipulate data for analysis of system capabilities and requirements.Core
  • 856Provide support to security/certification test and evaluation activities.Core
  • 860ATrace system requirements to design components and perform gap analysis.Additional
  • 874Utilize models and simulations to analyze or predict system performance under different operating conditions.Additional
  • 877AVerify stability, interoperability, portability, and/or scalability of system architecture.Additional
  • 936Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centers).Additional
  • 997Design and develop key management functions (as related to cybersecurity).Core
  • 998Analyze user needs and requirements to plan and conduct system security development.Core
  • 999Develop cybersecurity designs to meet specific operational needs and environmental factors (e.g., access controls, automated applications, networked operations, high integrity and availability requirements, multilevel security/processing of multiple classification levels, and processing Sensitive Compartmented Information).Additional
  • 1000Ensure security design and cybersecurity development activities are properly documented (providing a functional description of security implementation) and updated as necessary.Core
  • 1152Implement and integrate system development life cycle (SDLC) methodologies (e.g., IBM Rational Unified Process) into development environment.Core
  • 2354Employ configuration management processes.Core
  • 5200Design, implement, test, and evaluate secure interfaces between information systems, physical systems, and/or embedded technologies.Core

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 8AKnowledge of access authentication methods.Core
  • 21Knowledge of computer algorithms.Core
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 25Knowledge of encryption algorithms (e.g., Internet Protocol Security [IPSEC], Advanced Encryption Standard [AES], Generic Routing Encapsulation [GRE], Internet Key Exchange [IKE], Message Digest Algorithm [MD5], Secure Hash Algorithm [SHA], Triple Data Encryption Standard [3DES]).Core
  • 27AKnowledge of cryptology.Core
  • 34Knowledge of database systems.Core
  • 38Knowledge of organization's enterprise information security architecture system.Core
  • 40Knowledge of organization's evaluation and validation requirements.Additional
  • 42Knowledge of electrical engineering as applied to computer architecture, including circuit boards, processors, chips, and associated computer hardware.Additional
  • 43AKnowledge of embedded systems.Core
  • 46Knowledge of fault tolerance.Core
  • 51Knowledge of how system components are installed, integrated, and optimized.Core
  • 52Knowledge of human-computer interaction principles.Core
  • 63Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).Core
  • 64Knowledge of information security systems engineering principles.Core
  • 65AKnowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).Additional
  • 70Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).Core
  • 72Knowledge of local area and wide area networking principles and concepts including bandwidth management.Core
  • 75Knowledge of mathematics, including logarithms, trigonometry, linear algebra, calculus, and statistics.Additional
  • 78Knowledge of microprocessors.Additional
  • 79Knowledge of network access, identity, and access management (e.g., public key infrastructure [PKI]).Core
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Core
  • 82AKnowledge of network design processes, to include understanding of security objectives, operational objectives, and tradeoffs.Core
  • 90Knowledge of operating systems.Core
  • 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Core
  • 94Knowledge of parallel and distributed computing concepts.Core
  • 98Knowledge of policy-based and risk adaptive access controls.Core
  • 100Knowledge of Privacy Impact Assessments.Additional
  • 101Knowledge of process engineering concepts.Core
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 109Knowledge of secure configuration management techniques.Core
  • 110AKnowledge of security management.Core
  • 118Knowledge of software development models (e.g., Waterfall Model, Spiral Model).Core
  • 119Knowledge of software engineering.Core
  • 121Knowledge of structured analysis principles and methods.Core
  • 124Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.Core
  • 126Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.Core
  • 129Knowledge of system life cycle management principles, including software security and usability.Core
  • 130Knowledge of systems testing and evaluation methods.Core
  • 133Knowledge of key telecommunications concepts (e.g., Routing Algorithms, Fiber Optics Systems Link Budgeting, Add/Drop Multiplexers).Additional
  • 144Knowledge of the systems engineering process.Core
  • 177AKnowledge of countermeasure design for identified security risks.Additional
  • 904Knowledge of interpreted and compiled computer languages.Additional
  • 1034AKnowledge of Personally Identifiable Information (PII) data security standards.Additional
  • 1034BKnowledge of Payment Card Industry (PCI) data security standards.Additional
  • 1034CKnowledge of Personal Health Information (PHI) data security standards.Additional
  • 1037Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.Additional
  • 1038BKnowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability.Core
  • 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Core
  • 1073Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Core
  • 1125Knowledge of Cloud-based knowledge management technologies and concepts related to security, governance, procurement, and administration.Additional
  • 1133Knowledge of service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).Core
  • 1135Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).Additional
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Additional
  • 1142Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).Core
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3BSkill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.Core
  • 173ASkill in integrating and applying policies that meet system security objectives.Additional
  • 177Skill in designing countermeasures to identified security risks.Core
  • 179Skill in designing security controls based on cybersecurity principles and tenets.Core
  • 180Skill in designing the integration of hardware and software solutions.Additional
  • 191Skill in developing and applying security system access controls.Additional
  • 197Skill in discerning the protection needs (i.e., security controls) of information systems and networks.Core
  • 199Skill in evaluating the adequacy of security designs.Core
  • 224ASkill in the use of design modeling (e.g., unified modeling language).Additional
  • 1002Skill in conducting audits or reviews of technical systems.Core
  • 1140ASkill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities into applications (e.g., S/MIME email, SSL traffic).Additional

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 6918Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.Additional
  • 6919Ability to determine the best cloud deployment model for the appropriate operating environment.Additional

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

Equivalents

NICE work roles

From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

Free · DoD DCWF Tool v5.3 (2026-09-25)

O*NET jobs it reaches

Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

Free · O*NET 30.3