Penn State Job Catalog

Additional levels that exist for this job profile can be seen below.
Missing levels within the leveling matrix can be added based on business need.

The defined natural career progression within or between job profiles.

Cyber Security Information Analyst (ARL)

The Cyber Security Information Analyst supports the protection, authorization, and continuous monitoring of information systems and networks within the Applied Research Laboratory (ARL), a Department of Defense (DoD)-aligned University Affiliated Research Center (UARC); evaluates enterprise systems, assesses cybersecurity risk, and implements security controls in accordance with federal regulations, DoD requirements, University policies, and contractual obligations; applies cybersecurity engineering principles and Risk Management Framework (RMF) methodologies to ensure the confidentiality, integrity, and availability of ARL information systems; supports system authorization (A&A) activities, vulnerability management, compliance assessments, and continuous monitoring programs while safeguarding Controlled Unclassified Information (CUI), Export-Controlled Information, and other sensitive data supporting national security research. Notice regarding employment at the Applied Research Laboratory (ARL): Employees must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors. ARL operates in a secure information environment involving Unclassified, Controlled Unclassified Information (CUI), and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas.

• Conduct cybersecurity risk assessments across information systems, networks, and applications to evaluate security posture and provide recommendations aligned with DoD cybersecurity requirements and organizational risk tolerance
• Perform vulnerability scanning, configuration compliance assessments, and security control validation to identify deviations from approved baselines, security standards, and authorized system configurations
• Develop, document, and maintain Plans of Action and Milestones (POA&M) to track remediation of identified vulnerabilities, control deficiencies, and compliance gaps; monitor corrective actions through resolution
• Support Risk Management Framework (RMF) activities, including system categorization, security control selection and implementation, assessment preparation, authorization package development, and continuous monitoring support
• Assist in the authorization and accreditation (A&A) process by preparing and maintaining security documentation, including System Security Plans (SSPs), security control assessments, and supporting artifacts required for system approval to operate
• Establish and manage cybersecurity governance and control processes to ensure continuous compliance with applicable federal, DoD, and institutional security requirements
• Conduct periodic audits and continuous monitoring of systems to ensure ongoing compliance with security controls, configuration management standards, and approved baselines
• Implement and validate cybersecurity policies, procedures, technical safeguards, and configuration standards; provide recommendations for strengthening security posture and reducing organizational risk
• Collaborate with system owners, engineers, researchers, IT administrators, and security personnel to define security requirements and ensure secure system design, deployment, and operation
• Support the protection of Controlled Unclassified Information (CUI), Export-Controlled Information, research data, and other sensitive information through enforcement of access controls, encryption requirements, secure configurations, and monitoring practices
• Develop and maintain procedures for incident response support, forensic readiness, evidence preservation, and chain-of-custody documentation in coordination with cybersecurity and security operations teams
• Participate in incident response activities, including investigation support, containment coordination, and post-incident analysis, as required
• Evaluate emerging cybersecurity threats, vulnerabilities, technologies, and best practices; assess applicability and recommend improvements to existing security programs and controls
• Ensure compliance with applicable cybersecurity frameworks, including NIST SP 800-53, NIST Risk Management Framework (RMF), DoD cybersecurity policies, and organizational security directives
• Support audit readiness and external assessments by preparing documentation, responding to security inquiries, and validating compliance with required cybersecurity controls
• Collaborate with cybersecurity, information assurance, security operations, system administration, export control, compliance, and research stakeholders to ensure coordinated and consistent security implementation across the enterprise
• May supervise staff, including hiring, onboarding, training, work assignment, performance management, and professional development

Level:

– Intermediate Professional

Base Description:

– Completes activities, tasks, and/or projects of a functional nature.

Level Summary:

– Demonstrates ability to perform intermediate tasks in defined skill areas. Demonstrates intermediate knowledge of internal procedures. Works under general supervision, performing assignments that may be varied and sometimes difficult. Supports team decisions and follows through with team responsibilities. Interprets and communicates information clearly and accurately. Demonstrates intermediate problem–solving skills.

Supervisory Responsibilities:

– May serve as direct supervisor for part–time, student, and/or temporary workers or volunteers

Fiscal Responsibilities:

– May validate and pay invoices

Problem Solving:

– Encounters generally routine problems; occasionally faces more complex and/or varied problems
– Typically follows recommended course of action and procedures to resolve problems
– Applies knowledge of larger unit goals, priorities, and related procedures in determining course of action

Independence of Action:

– Work is generally monitored by supervisor
– Detailed instructions and procedures are generally provided
– Uses available guidelines to make appropriate adaptations to routine situations and refers other situations to supervisor

Communication and Collaboration:

– Communicates internally within working unit and/or the University
– May communicate with external audiences
– Collaborates closely with team members
– Interprets and communicates information, ideas and instructions clearly and accurately both verbally and in written materials intended for distribution

• Comp Grade – K
• Minimum – $80,100.00
• MidPoint – $106,104.00
• Maximum – $132,204.00

• Computer network security
• Consulting
• Document management
• Information assurance
• Policy analysis
• Process design
• Research methods
• Risk analysis
• System auditing
• System design
• Technical Writing