Penn State Job Catalog

Additional levels that exist for this job profile can be seen below.
Missing levels within the leveling matrix can be added based on business need.

The defined natural career progression within or between job profiles.

Cyber Security Engineer (ARL)

Cyber Security Information Analyst (ARL)

The Information Systems Security Manager provides strategic leadership, governance, and operational oversight for cybersecurity programs that protect the Applied Research Laboratory's (ARL) information systems, research computing environments, and digital assets supporting Department of Defense (DoD) and other federal sponsors; leads cybersecurity operations, risk management, incident response, compliance, and continuous monitoring activities to safeguard the confidentiality, integrity, and availability of enterprise information systems supporting unclassified, Controlled Unclassified Information (CUI), export-controlled, and classified research; develops and implements enterprise cybersecurity strategies, policies, standards, and architectures aligned with federal regulations, contractual requirements, and industry best practices; oversees Cyber Information Security Analysts, Cyber Security Engineers, and other IT personnel responsible for security operations, vulnerability management, compliance assessments, identity and access management, incident response, and security engineering while serving as a trusted advisor to executive leadership on cyber risk, resilience, and strategic security initiatives. Notice regarding employment at the Applied Research Laboratory (ARL): Employees must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors. ARL operates in a secure information environment involving Unclassified, Controlled Unclassified Information (CUI), and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas.

• Provide strategic leadership for enterprise cybersecurity programs supporting research, business, engineering, operational, and classified information systems
• Lead Cyber Information Security Analysts, Cyber Security Engineers, and other IT professionals, including hiring, mentoring, workforce development, performance management, and succession planning
• Develop, implement, and maintain enterprise cybersecurity strategies, governance frameworks, policies, standards, procedures, and technical baselines aligned with organizational objectives and federal requirements
• Oversee security operations, including intrusion detection, threat intelligence, threat hunting, continuous monitoring, security event analysis, and information sharing to identify and respond to emerging cyber threats
• Direct incident response activities to ensure cybersecurity events are properly identified, contained, investigated, documented, remediated, and reported in accordance with established procedures and contractual obligations
• Oversee the development, maintenance, testing, and continuous improvement of incident response, cyber resilience, disaster recovery, and business continuity plans
• Lead enterprise vulnerability management activities, including vulnerability assessments, penetration testing coordination, remediation prioritization, configuration compliance, and security validation of enterprise systems and applications
• Oversee enterprise risk assessments and security compliance reviews to ensure information systems remain compliant with organizational policies, sponsor requirements, and applicable federal cybersecurity frameworks
• Establish and maintain security controls supporting secure system development, cloud environments, research computing, databases, networks, identity and access management, privileged access, and enterprise applications
• Lead implementation of continuous monitoring strategies, security metrics, dashboards, and Key Performance Indicators (KPIs) to evaluate cybersecurity effectiveness, organizational risk, and operational maturity
• Direct cybersecurity compliance activities supporting applicable federal requirements, including NIST Risk Management Framework (RMF), NIST SP 800-171, NIST SP 800-53, DFARS cybersecurity requirements, CMMC (when contractually applicable), and other sponsor-specific security requirements
• Collaborate with research leadership, system owners, and enterprise technology teams to ensure cybersecurity requirements are integrated throughout the system lifecycle
• Support system authorization activities, security assessments, Plans of Action and Milestones (POA&Ms), security documentation, audit readiness, and corrective action tracking
• Oversee identity, credential, and access management processes to ensure users receive appropriate access based on least privilege, need-to-know, and separation-of-duties principles
• Promote cybersecurity awareness by developing security education programs covering topics such as phishing, insider threat awareness, operational security (OPSEC), secure handling of CUI, identity protection, and acceptable use requirements
• Collaborate with enterprise architects and technology leadership to ensure cybersecurity requirements are incorporated into future infrastructure, cloud, software, and enterprise technology initiatives
• Establish Service Level Agreements (SLAs), operational metrics, and performance objectives for cybersecurity services while identifying opportunities for automation, modernization, and continuous improvement
• Coordinate internal assessments, external audits, sponsor reviews, and cybersecurity inspections; oversee remediation activities and ensure timely resolution of findings
• Protect sensitive, proprietary, export-controlled, Controlled Unclassified Information (CUI), and classified information in accordance with applicable federal regulations, contractual requirements, and institutional security policies

Level:

– Senior Manager

Base Description:

– Manages direct reports where primary duty is the management of a working unit.

Level Summary:

– Demonstrates advanced skills in critical functions related to unit's success. Demonstrates advanced knowledge of emerging technologies and processes. Monitors completed work of others to ensure effectiveness and adherence to requirements. Sets clear expectations and holds team accountable. Establishes a shared team/unit vision. Demonstrates ability to evaluate and enhance team/unit practices that promote a strong commitment to inclusionary practices. Coaches others using appropriate strategies. Demonstrates diplomacy. Demonstrates ability to serve as liaison between senior-level management and staff. Resolves complex, controversial, or unprecedented issues and problems.

Supervisory Responsibilities:

– Oversees large team or teams of individual contributors and/or supervisors/managers
– Leads a department or functional area

Fiscal Responsibilities:

– Monitors and tracks large budgets
– Plans, forecasts, and/or develops budgets
– May approve budgets for specific area
– Typically has final signature authority for specific area

Problem Solving:

– Encounters highly varied and complex problems that impacts the team and possibly the unit
– Develops creative and/or novel approaches to resolve problems that are difficult in nature
– Independently resolves complex and/or unprecedented issues and problems

Independence of Action:

– Work results are not clearly defined
– Generally sets own goals and determines how to accomplish results with few or no guidelines to follow
– Monitors completed work of others to ensure soundness of approach, effectiveness of meeting requirements, the feasibility of recommendations and adherences to requirements
– Delegates more advanced tasks to others

Communication and Collaboration:

– Communicates with both internal and external audiences
– Collaborates closely with team members and various areas across the University
– Fosters collaboration between units and engages others' coordinated efforts to reach desired outcomes with broad scope

• Comp Grade – O
• Minimum – $140,004.00
• MidPoint – $185,508.00
• Maximum – $231,000.00

• Access management
• Computer network security
• Database management
• Incident management
• Information governance
• Policy analysis
• Project Management
• Resource management
• Risk Management
• System design
• Technical development