Penn State Job Catalog

Additional levels that exist for this job profile can be seen below.
Missing levels within the leveling matrix can be added based on business need.

The defined natural career progression within or between job profiles.

Cyber Security Information Analyst (ARL)

The Cyber Security Information Analyst supports the protection, authorization, and continuous monitoring of information systems and networks within the Applied Research Laboratory (ARL), a Department of Defense (DoD)-aligned University Affiliated Research Center (UARC); evaluates enterprise systems, assesses cybersecurity risk, and implements security controls in accordance with federal regulations, DoD requirements, University policies, and contractual obligations; applies cybersecurity engineering principles and Risk Management Framework (RMF) methodologies to ensure the confidentiality, integrity, and availability of ARL information systems; supports system authorization (A&A) activities, vulnerability management, compliance assessments, and continuous monitoring programs while safeguarding Controlled Unclassified Information (CUI), Export-Controlled Information, and other sensitive data supporting national security research. Notice regarding employment at the Applied Research Laboratory (ARL): Employees must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors. ARL operates in a secure information environment involving Unclassified, Controlled Unclassified Information (CUI), and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas.

• Conduct cybersecurity risk assessments across information systems, networks, and applications to evaluate security posture and provide recommendations aligned with DoD cybersecurity requirements and organizational risk tolerance
• Perform vulnerability scanning, configuration compliance assessments, and security control validation to identify deviations from approved baselines, security standards, and authorized system configurations
• Develop, document, and maintain Plans of Action and Milestones (POA&M) to track remediation of identified vulnerabilities, control deficiencies, and compliance gaps; monitor corrective actions through resolution
• Support Risk Management Framework (RMF) activities, including system categorization, security control selection and implementation, assessment preparation, authorization package development, and continuous monitoring support
• Assist in the authorization and accreditation (A&A) process by preparing and maintaining security documentation, including System Security Plans (SSPs), security control assessments, and supporting artifacts required for system approval to operate
• Establish and manage cybersecurity governance and control processes to ensure continuous compliance with applicable federal, DoD, and institutional security requirements
• Conduct periodic audits and continuous monitoring of systems to ensure ongoing compliance with security controls, configuration management standards, and approved baselines
• Implement and validate cybersecurity policies, procedures, technical safeguards, and configuration standards; provide recommendations for strengthening security posture and reducing organizational risk
• Collaborate with system owners, engineers, researchers, IT administrators, and security personnel to define security requirements and ensure secure system design, deployment, and operation
• Support the protection of Controlled Unclassified Information (CUI), Export-Controlled Information, research data, and other sensitive information through enforcement of access controls, encryption requirements, secure configurations, and monitoring practices
• Develop and maintain procedures for incident response support, forensic readiness, evidence preservation, and chain-of-custody documentation in coordination with cybersecurity and security operations teams
• Participate in incident response activities, including investigation support, containment coordination, and post-incident analysis, as required
• Evaluate emerging cybersecurity threats, vulnerabilities, technologies, and best practices; assess applicability and recommend improvements to existing security programs and controls
• Ensure compliance with applicable cybersecurity frameworks, including NIST SP 800-53, NIST Risk Management Framework (RMF), DoD cybersecurity policies, and organizational security directives
• Support audit readiness and external assessments by preparing documentation, responding to security inquiries, and validating compliance with required cybersecurity controls
• Collaborate with cybersecurity, information assurance, security operations, system administration, export control, compliance, and research stakeholders to ensure coordinated and consistent security implementation across the enterprise
• May supervise staff, including hiring, onboarding, training, work assignment, performance management, and professional development

Level:

– Senior Professional

Base Description:

– Completes activities, tasks, and/or projects of a functional nature.

Level Summary:

– Demonstrates advanced knowledge of principles, practices, and procedures of a particular field. Works independently on moderately complex work assignments under limited oversight, reviews progress, and evaluates results. Monitors work and projects ensuring timeliness, quality, and efficiency. Identifies and mobilizes resources to achieve outcomes. Trains others and reviews progress with management. Presents ideas, concepts, and instructions in a clear and persuasive manner. Develops new techniques, concepts, and approaches and applies them to moderately complex and strategic and/or operational issues.

Supervisory Responsibilities:

– Indirect supervisor for other full–time employees
– May serve as direct supervisor for part–time, student, and/or temporary workers, volunteers, or a full–time employee

Fiscal Responsibilities:

– May validate and pay invoices
– Monitors and tracks budgets and funding

Problem Solving:

– Encounters moderately complex problems
– Applies specialized knowledge and skills to resolve problems
– Understands benefits, limitations, and impact of potential solutions

Independence of Action:

– Works independently on moderately complex work assignments, reviews progress, and evaluates results
– May set priorities and organize work within general guidelines established by supervisor
– May review the work of others to verify accuracy and conformance to required procedures and special instructions

Communication and Collaboration:

– Communicates internally within working unit and the University
– Communicates with external audiences for scheduling/coordination
– May communicate with external audiences for business purposes
– Coaches others in using appropriate strategies for resolving conflict; negotiating reasonable compromises; and proposing and evaluating possible solutions
– Give candid and constructive feedback to others to influence and persuade managers and employees to accept and implement findings and recommendations

• Comp Grade – M
• Minimum – $105,900.00
• MidPoint – $140,304.00
• Maximum – $174,708.00

• Computer network security
• Consulting
• Document management
• Information assurance
• Policy analysis
• Process design
• Research methods
• Risk analysis
• System auditing
• System design
• Technical Writing