2026-0019, Security Accreditation Activities

Duties

In close coordination with the Site Security Officer (SSO) at each remote site, the CIS capability Service Delivery manager and the NCIA Security Accreditation Office, the Contractor’s personnel shall perform the following activities:

3.1 Review existing security documentation and update it as required, to ensure compliance with security guidelines

3.2 Maintain a document library that contains the most updated site and system security documentation

3.3 Establish periodic communication with Site Security Officers to trigger and monitor their actions in updating site specific documentation within the agreed timelines

3.4 Create, and present to the customer, a periodic report that shows the security compliancy and pending actions of each site in terms of security related documentation

3.5 Keep existing user and administrator CIS Security Operating Procedures up-to-date

3.6 Create a basic training package, in PowerPoint format, that describes the actions each Site Security Officer shall perform to maintain local security documentation in compliance with security directives and guidelines

3.7 Review and provide constructive feedback on:

3.7.1 Security Test and Verification Plans and Reports (STVP / STVR)

3.7.2 CIS Security description documents related to managed CIS systems

Requirements

12.1 Comprehensive knowledge of the principles of computers and communication security, networking, and the vulnerabilities of modern operating systems and applications.

12.2 At least five years of experience developing, maintaining, and updating CIS Security policies, standards, procedures and guidelines.

12.3 Proven track record of mapping organizational security documentation to the CIS Security Controls and supporting compliance and audit readiness efforts.

12.4 Hands-on experience conducting periodic reviews, gap analyses, and continuous improvement of security documentation to reflect evolving regulatory requirements.

12.5 At least five years of experience collaborating with technical, operational and compliance stakeholders to ensure security procedures are accurate and aligned with the business risk management objectives

12.6 Demonstrable previous experience in maintaining version-controlled security documentation repositories and ensuring proper change management, approval workflow and traceability

12.7 At least three years of experience planning, conducting and documenting security testing and verification activities, such as control validation, CIS system configuration reviews and procedural walk-throughs, to confirm the effectiveness and operational readiness of CIS-security aligned security controls

12.8 Very good knowledge of spoken and written English as work is conducted in English

12.9 The possession of one or more of the following industry certifications will be considered as an asset:

12.9.1 Certified Information Systems Security Professional (CISSP)

12.9.2 Certified Information Security Manager (CISM)

12.9.3 Certified in Risk and Information Systems Control)