Skip to content

Cybersecurity · Work role code 722

Information Systems Security Manager

Responsible for the cybersecurity of a program, organization, system, or enclave.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 395Advise senior management (e.g., CIO) on risk levels and security posture.Core
  • 397Advise appropriate senior leadership or Authorizing Official of changes affecting the organization's cybersecurity posture.Core
  • 426Assess threats to and vulnerabilities of computer system(s) to develop a security risk profile.Core
  • 440Collect and maintain data needed to meet system cybersecurity reporting.Core
  • 445Communicate the value of information technology (IT) security throughout all levels of the organization stakeholders.Core
  • 475Collaborate with stakeholders to establish the enterprise continuity of operations program, strategy, and mission assurance.Core
  • 572Ensure application of security patches for commercial products integrated into system design meet the timelines dictated by the management authority for the intended operational environment.Core
  • 578Ensure security improvement actions are evaluated, validated, and implemented as required.Core
  • 584Ensure that cybersecurity inspections, tests, and reviews are coordinated for the network environment.Core
  • 585Ensure that cybersecurity requirements are integrated into the continuity planning for that system and/or organization(s).Core
  • 640Identify information technology (IT) security program implications of new technologies or technology upgrades.Core
  • 676Interpret and/or approve security requirements relative to the capabilities of new information technologies.Core
  • 677Interpret patterns of non compliance to determine their impact on levels of risk and/or overall effectiveness of the enterprise’s cybersecurity program.Core
  • 692Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.Core
  • 705Manage the monitoring of information security data sources to maintain organizational situational awareness.Core
  • 711Monitor and evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensure they provide the intended level of protection.Core
  • 733Participate in the development or modification of the computer environment cybersecurity program plans and requirements.Core
  • 741ACoordinate incident response functions.Core
  • 790Prepare, distribute, and maintain plans, instructions, guidance, and standard operating procedures concerning the security of network system(s) operations.Core
  • 818Provide technical documents, incident reports, findings from computer examinations, summaries, and other situational awareness information to higher headquarters.Core
  • 824Recognize a possible security violation and take appropriate action to report the incident, as required.Core
  • 848Recommend policy and coordinate review and approval.Core
  • 862Track audit findings and recommendations to ensure appropriate mitigation actions are taken.Core
  • 948Participate in Risk Governance process to provide security risks, mitigations, and input on other technical risk.Core
  • 962Identify security requirements specific to an information technology (IT) system in all phases of the System Life Cycle.Core
  • 963Ensure plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.Core
  • 963AEnsure risk mitigation plans of action and milestones are in place.Core
  • 964Ensure successful implementation and functionality of security requirements and appropriate information technology (IT) policies and procedures that are consistent with the organization's mission and goals.Core
  • 1016Support necessary compliance activities (e.g., ensure system security configuration guidelines are followed, compliance monitoring occurs).Core
  • 8267Communicate the security impact levels for the identified information types to organization stakeholders.Core
  • 8268Ensure implementation of IAVM dissemination, reporting, and compliance procedures.Core
  • 8271Ensure that all DoD IS cybersecurity-related documentation is current and accessible to properly authorized individuals.Core
  • 8272Evaluate a system-level risk assessment and update the risk assessment results on an ongoing basis.Core
  • 8273Maintain information systems assessment and authorization documents/artifacts.Core
  • 8276Oversee and track all ISs within their area of responsibility and ensure the Authority To Operate is current.Core
  • 8277Participate in the Configuration Control Board.Core
  • 8278Prepare, distribute, and maintain plans, instructions, and SOPs concerning system security.Core
  • 8279Responsible for maintaining the security of the system, including the monitoring, and reporting of the system security status.Core
  • 8281Support the defining of security and privacy requirements for the system and the environment of operations.Core
  • 8282Support the registration of the system with organizational program or management offices.Core

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 9Knowledge of applicable business processes and operations of customer organizations.Additional
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 29Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.Core
  • 37Knowledge of disaster recovery continuity of operations plans.Core
  • 49Knowledge of host/network access control mechanisms (e.g., access control list).Core
  • 55Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.Core
  • 58Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.Core
  • 60Knowledge of incident categories, incident responses, and timelines for responses.Core
  • 61Knowledge of incident response and handling methodologies.Core
  • 66Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.Core
  • 69AKnowledge of risk management processes and requirements per the Risk Management Framework (RMF).Core
  • 76Knowledge of measures or indicators of system performance and availability.Core
  • 77Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.Core
  • 81AKnowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.Core
  • 92Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).Core
  • 105Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).Core
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 113Knowledge of server and client operating systems.Core
  • 126Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.Core
  • 129Knowledge of system life cycle management principles, including software security and usability.Core
  • 132Knowledge of technology integration processes.Core
  • 143Knowledge of the organization’s enterprise information technology (IT) goals and objectives.Core
  • 150Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.Core
  • 299Knowledge of information security program management and project management principles and techniques.Core
  • 965Knowledge of organization's risk tolerance and/or risk management approach.Core
  • 966Knowledge of enterprise incident response program, roles, and responsibilities.Core
  • 967Knowledge of current and emerging threats/threat vectors.Core
  • 992BKnowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored).Core
  • 1033Knowledge of basic system administration, network, and operating system hardening techniques.Core
  • 1034AKnowledge of Personally Identifiable Information (PII) data security standards.Core
  • 1034CKnowledge of Personal Health Information (PHI) data security standards.Core
  • 1036Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed.Core
  • 1037Knowledge of information technology (IT) supply chain security and risk management policies, requirements, and procedures.Core
  • 1038BKnowledge of local specialized system requirements (e.g., critical infrastructure/control systems that may not use standard information technology [IT]) for safety, performance, and reliability.Core
  • 1040AKnowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.Core
  • 1072Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth, Zero Trust).Core
  • 1073Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.Core
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Core
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 4430Knowledge of cybersecurity Risk Management Framework (RMF) process.Core
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core
  • 7159Knowledge of an Information Security Continuous Monitoring program and Configuration Management process.Core
  • 7169Knowledge of incident categories, incident responses, and timelines for responses.Core
  • 7173Knowledge of maintaining the appropriate operational security posture for an information system or program.Core
  • 7182Knowledge on how to document the provisional impact level of confidentiality, integrity, and availability associated with the system’s information type.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 173Skill in creating policies that reflect system security objectives.Core
  • 183Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.Core
  • 3815Skill in interpreting vulnerability scanner results to identify vulnerabilities.Core
  • 7183Skill in addressing security concerns related to the Configuration Management (CM) program and for providing expertise and decision support to the Configuration Control Review Board (CCRB).Core

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 4251Ability to evaluate compliance with Security Technical Implementation Guides (STIGs) on host machines by utilizing a compliance scanner in support of identifying outliers in order to delineate possible avenues of approachCore
  • 4723Ability to recognize and respond to unanticipated events (e.g., identification of information spillage, misuse of government information systems) during Red Team operations, in accordance with organizational policies.Core
  • 6918Ability to apply cybersecurity strategy to cloud computing service and deployment models, identifying proper architecture for different operating environments.Core

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

Equivalents

NICE work roles

From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

Free · DoD DCWF Tool v5.3 (2026-09-25)

O*NET jobs it reaches

Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

Free · O*NET 30.3