Position Overview

The National Oceanic and Atmospheric Administration (NOAA) National Marine Fisheries Service (NMFS) Office of the Chief Information Officer (OCIO) is seeking a Windows System Administrator to support design, deployment, modernization, and operations of Windows Server–based workloads hosted in Google Cloud Platform (GCP). This role will partner with infrastructure, security, and application teams to deliver stable, secure, automated Windows environments, with strong emphasis on scripting, virtualization, and identity integration.

Work Location:  Remote (Ideally located to the D.C., MD, & VA area)

Clearance:   Public Trust

Job Responsibilities and/or Success Factors

• Cloud-hosted Windows engineering:
  • Build, configure, and operate Windows Server workloads in cloud environments (preferably GCP) including image standards, patching patterns, performance tuning, and availability design.
    
    
• Operating systems & virtualization:
  • Administer and troubleshoot Windows Server environments.
    
    
• Identity & access integration:
  • Implement and maintain Active Directory (AD) integrations, Group Policy, and IAM (Identity & Access Management) controls; support role-based access, privileged access patterns, and audit-ready configuration.
    
    
• Automation & scripting:
  • Develop and maintain PowerShell automation for provisioning, configuration drift remediation, patch orchestration, and routine operations; contribute to Automation standards and reusable runbooks.
    
    
• Infrastructure as Code (IaC):
  • Partner with platform/DevOps teams to implement Windows infrastructure using IaC patterns (templates/modules), promoting repeatability and environment consistency.
    
    
• Backup & resilience:
  • Implement and test Backup & Recovery procedures; support Disaster Recovery planning, runbooks, and periodic failover testing aligned to recovery objectives.
    
    
• Monitoring & troubleshooting:
  • Integrate Windows workloads into enterprise Monitoring solutions; triage incidents, perform root-cause analysis, and drive permanent fixes and operational improvements.
    
    
• Security hardening:
  • Apply secure baselines, vulnerability remediation, and configuration controls aligned to organizational policies; coordinate remediation efforts across OS, identity, and network layers.
    
    
• Documentation & knowledge transfer:
  • Produce and maintain living documentation (runbooks, SOPs, diagrams) and support handoffs to operations teams.

Education and Minimum Qualifications

• 5+ years hands-on experience administering and supporting Windows Server in enterprise environments (mid-level profile).
• Strong experience with PowerShell for administration and automation.
• Practical experience with Active Directory (AD) and Group Policy administration in production environments.
• Experience supporting Backup & Recovery, Disaster Recovery, and Monitoring practices for Windows workloads.
• Ability to operate in mixed environments where Linux is often required alongside Windows (triage, interoperability, handoffs).
• Strong troubleshooting skills, documentation discipline, and ability to collaborate across infra, security, and app teams.

Desired Qualifications

• Experience running Windows workloads on Google Cloud Platform (GCP) (Compute Engine, networking patterns, IAM integration concepts).
• Google Cloud certifications (any relevant certification is a plus).
• Experience applying STIG (Security Technical Implementation Guide) baselines and supporting compliance/hardening validation for Windows systems.
• Experience implementing or contributing to Infrastructure as Code (IaC) and automation pipelines for Windows platforms.
• Exposure to endpoint/server hardening standards, vulnerability management workflows, and audit support.

Position Description:
This position is responsible for supporting National Oceanic and Atmospheric Administration’s (NOAA's) Internal Risk Management Program (IRMP) by designing, implementing, and maintaining comprehensive insider threat detection and mitigation capabilities. The Insider Threat Program Analyst will develop and operationalize policies, systems, and practices to detect, deter, and respond to potential insider threats within NOAA's workforce, including government employees, contractors, and uniformed services. The ideal candidate will have expertise in security data analysis, risk assessment, and collaboration with internal and external stakeholders to ensure the protection of sensitive information, systems, and assets. This role requires strong analytical skills and the ability to identify behavioral indicators of insider threats while maintaining compliance with privacy regulations and ethical standards.

Location:  Hybrid (Silver Spring, MD)


Clearance:  Active TS/SCI

Responsibilities and/or Success Factors: Program Support and Internal Risk Operations

• Support development and implementation of a comprehensive Internal Risk Management Program (IRMP) that detects, deters, and responds to insider threats across NOAA’s workforce, including employees, contractors, and uniformed personnel. 
• Assist with crafting and maintaining internal risk/insider threat policies, procedures, and governance artifacts; ensure alignment with federal directives and NOAA policy. Data Integration and Analytics 
• Consolidate and analyze security data from multiple sources (e.g., cybersecurity telemetry/SIEM, User Access Management (UAM), Human Resources (HR), physical access, case management, and lawful external data) into a cohesive risk picture that provides actionable insights to leadership. 
• Develop analytic methods and behavioral indicators; produce dashboards and routine analytical products to inform risk prioritization and mitigation activities. 
• Monitor system integration performance and data quality; recommend improvements to achieve target integration milestones and performance metrics. Case Management and Incident Response 
• Execute insider threat reporting and response procedures; triage, document, and track matters in the IRMP HUB case management tools; coordinate formal referrals and follow-up actions.
• Support insider threat incident investigations, response, and mitigation; document timelines, actions, lessons learned, and protocol adjustments. 
• Meet timeliness standards for incident documentation and reporting (e.g., initial reporting within three business days) and ensure evidence handling aligns with applicable policy. Training, Awareness, and Culture 
• Develop and deliver insider threat and internal risk training and awareness content; assess training effectiveness via post-training surveys and performance metrics. 
• Drive adoption of best practices to embed a proactive, ethical, and privacy-aware internal risk culture across NOAA; tailor content to roles and mission contexts. 
• Maintain training artifacts and schedules; recommend continuous improvement actions based on feedback and outcomes. Research Security and Compliance (NSPM-33) 
• Support development and implementation of research security protocols and compliance measures to protect sensitive research and deter foreign interference. 
• Assist with assessments, gap analyses, and corrective action planning to achieve and sustain compliance with NSPM-33 and related standards. Collaboration and Stakeholder Engagement • Coordinate with internal stakeholders (e.g., Cybersecurity Division, HR, Legal/Privacy/Civil Liberties, Research Security, Security Management) and external partners (e.g., NITTF, SEI CERT). 
• Document stakeholder engagements, action items, and outcomes; track completion and effectiveness. Reporting and Deliverable Execution 
• Develop and maintain program artifacts and deliverables, which may include: Risk Mitigation Strategy documents; Research Security Compliance Reports; Training & Awareness Program Reports; Insider Threat Detection System Status Reports; Incident Response and Mitigation Reports; Risk Management dashboards/tools updated at least weekly; Policy and SOP updates; Stakeholder Engagement Reports; and annual/final program evaluations. 
• Ensure products are accurate, clear, Section 508 compliant, and aligned to acceptance criteria and performance standards. Risk Management and Continuous Improvement 
• Identify, track, and mitigate program and operational risks, including integration, privacy, and workforce continuity risks; propose practical workarounds and improvements. 
• Support development and maintenance of dependencies, milestones, resource plans, and tracking mechanisms to keep the roadmap on schedule. Security, Privacy, and Ethics Compliance 
• Adhere to NISPOM, Privacy Act, CUI handling, civil liberties protections, and NOAA security policies; safeguard CNSI and CUI per contract requirements. 
• Maintain required security training and certifications

Minimum Qualifications Including Certificates:

• Must be a U.S. Citizen 
• Active Top Secret security clearance with SCI eligibility (SCI access preferred); ability to maintain eligibility throughout performance 
• Bachelor’s degree in cybersecurity, information systems, intelligence/counterintelligence, behavioral science, criminology, data analytics, or a related field; equivalent experience may be considered 
• Five (5) or more years of experience in insider threat, internal risk, counterintelligence, security operations, or cyber analytics within federal, defense, or research environments 
• Demonstrated experience consolidating and analyzing multi-source security data (e.g., SIEM/UAM/HR/physical access); proficiency with dashboards and analytics (e.g., Smartsheet, Tableau, Power BI, Google Workspace) 
• Hands-on experience with insider threat/IRMP case management, incident response, and formal referral processes; strong documentation and chain-of-custody practices 
• Knowledge of and experience applying NITTF Minimum Standards, EO 13587, NSPM-33, NISPOM, FISMA, NIST standards (e.g., SP 800-53, 800-171), and CUI handling requirements 
• Experience developing and delivering training and awareness programs; ability to measure training effectiveness and drive continuous improvement 
• Strong written and oral communication skills; demonstrated ability to brief leadership and produce high-quality, timely reports and deliverables 
• Proven ability to collaborate with cross-functional stakeholders (Cybersecurity, HR, Legal/Privacy, Research Security, Security Management) and external partners (e.g., NITTF, SEI CERT) 
• Commitment to privacy, civil liberties, ethics, and Section 508 compliance in all program artifacts

Desired Qualifications: 

• NITTF Insider Threat Program personnel training/certification 
• Relevant professional certifications (e.g., CISSP, Security+, CEH, GCIH, GCFE, CISM, CCSP) 
• Experience supporting research security and NSPM-33 implementation within a federal research environment
• Experience with User and Entity Behavior Analytics/User Activity Monitoring (UEBA/UAM) solutions, SIEM platforms (e.g., Splunk), and case management systems; familiarity with SIPRNet/secure enclaves 
• Data analytics skills (e.g., SQL, Python) and experience building automated dashboards and metrics 
• Familiarity with CMU SEI CERT insider threat best practices and NOAA mission context 
• Experience producing program roadmaps, risk registers, and accepted program documentation under federal QASP/QASP-like surveillance

Position Description:

The Counterintelligence Analyst will support the NOAA Research Security Program by conducting specialized analyses to identify, assess, and mitigate threats to NOAA's critical technologies, intellectual property, and research data. This position requires a strong background in counterintelligence methodologies with specific experience in research security, technology protection, and foreign influence detection.

Location: (Hybrid) Silver Spring, MD  

Clearance:  Top Secret

Responsibilities and/or Success Factors: 

Threat Assessment and Analysis 

• Conduct comprehensive assessments of foreign influence risks in NOAA research programs
• Analyze intelligence reports and open-source information to identify potential threats to NOAA-sponsored research
• Perform due diligence research on foreign entities seeking collaboration with NOAA research programs.
• Support development of the NOAA Critical Assets List by identifying critical technologies vulnerable to foreign acquisition Policy and Procedure Development
• Assist in developing specialized due diligence processes for both classified (JWICS) and unclassified research security reviews
• Contribute to the export control policy development and technology control plan assessments 
• Draft standard operating procedures for counterintelligence-focused due diligence in research collaborations
• Support development of disclosure requirements standards and consequences for violations Security Framework Implementation
• Provide counterintelligence expertise for gap analysis of current NOAA research security posture
• Contribute to risk assessments of critical and emerging technologies as defined by NSPM-33
• Develop procedures for identifying and mitigating nation-state threats to NOAA research
• Assist in designing supply chain risk management processes to protect research integrity Training and Incident Response
• Develop specialized training materials focusing on foreign influence detection, technology protection, and threat awareness
• Support tabletop exercises and simulations specific to counterintelligence scenarios
• Contribute to incident response planning for cases of suspected foreign influence or unauthorized technology transfer
• Provide briefings to NOAA personnel on counterintelligence trends and threat indicators
  
  

Minimum Qualifications Including Certificates:

• Bachelor's degree in Intelligence Studies, International Relations, Cybersecurity, or related field
• Minimum 5 years of experience in counterintelligence, preferably in a government or research environment.
• In-depth knowledge of NSPM-33 requirements and research security frameworks 
• Experience with export control regulations (ITAR, EAR) and technology control procedures.
• Proficiency with classified and unclassified intelligence analysis tools and methodologies.
• Strong analytical skills and ability to synthesize information from multiple sources.
• Excellent written and verbal communication skills.

Security Requirement:

• Active Top Secret Clearance (SSBI/Tier 5) required prior to start.

• Must comply with DoD/NISPOM regulations and NOAA security requirements.

Position Description:
The Information Security Specialist III supports the National Oceanic and Atmospheric Administration (NOAA) Internal Risk Management Program (IRMP), providing advanced technical, analytical, and programmatic expertise in the prevention, detection, and mitigation of insider threats. This key personnel position executes and advances NOAA’s IRMP objectives in compliance with federal security regulations, most notably Executive Order 13587, National Insider Threat Policy, NIST, FISMA, NSPM-33, and agency-specific guidance. The Information Security Specialist III collaborates with OCIO leadership, the Internal Risk Office, NOAA research teams, and interagency insider threat task forces to strengthen the security posture of NOAA’s classified and unclassified environments.


Location:  Hybrid (Silver Spring, MD)

Clearance:  Active TS/SCI

Responsibilities and/or Success Factors: Information Security Program Development and Implementation

• Lead the development and implementation of comprehensive information security policies, procedures, and protocols for insider threat detection and mitigation 
• Design and establish security frameworks that integrate physical security, personnel security, cybersecurity, and information assurance functions 
• Develop research security protocols in compliance with NSPM-33 to protect sensitive NOAA research activities from internal and external threats 
• Create and maintain security guidelines for handling classified national security information (CNSI) and controlled unclassified information (CUI) Risk Assessment and Analysis 
• Conduct comprehensive risk assessments of NOAA's information systems, networks, and data repositories 
•  Analyze security vulnerabilities and develop mitigation strategies for identified risks
• Evaluate and assess compliance with federal security standards including FISMA, NIST frameworks, and DoD cybersecurity requirements 
• Perform security impact assessments for new systems, applications, and processes Security Data Integration and Monitoring 
• Consolidate and analyze security data from multiple internal and external sources to identify potential insider threats 
• Design and implement data integration systems that provide real-time monitoring and actionable insights to leadership 
• Develop and maintain insider threat detection systems and behavioral monitoring capabilities 
• Ensure ethical data collection and analysis practices that comply with privacy regulations and civil liberties requirements Incident Response and Investigation
• Coordinate incident response activities for suspected insider threat cases and security breaches 
• Conduct thorough investigations of security incidents involving classified systems and sensitive information 
• Document incident response actions and develop lessons learned for continuous program improvement 
• Collaborate with law enforcement agencies and external partners on complex security investigations Compliance and Audit Management 
• Ensure compliance with federal security regulations including Executive Order 13587, NSPM-33, FISMA, and NIST standards 
• Conduct regular security compliance audits and assessments 
• Prepare detailed compliance reports and corrective action plans for identified gaps
• Maintain documentation for security authorization and accreditation processes Training and Awareness Program Support 
• Develop technical training materials and awareness programs focused on insider threat identification and mitigation 
• Provide expert consultation on security best practices and threat scenarios
• Support the delivery of security training sessions for NOAA personnel, contractors, and uniformed services 
• Create technical resources and job aids for security awareness initiatives Stakeholder Collaboration and Communication 
• Serve as technical liaison with internal NOAA teams including the Cybersecurity Division and Human Resources 
• Communicate complex technical security concepts to non-technical stakeholders 
• Provide expert technical guidance to program leadership and government officials Policy Development and Documentation
• Develop and maintain comprehensive security policies and standard operating procedures (SOPs)
• Create technical documentation for security systems, processes, and procedures 
• Review and update security policies to ensure alignment with evolving threats and regulatory requirements 
• Contribute to the development of security guidelines and best practice documentation

Minimum Qualifications Including Certificates:

• Must be a U.S. Citizen 
• Active Top Secret security clearance with SCI eligibility (required before contract start) 
• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related STEM field from an accredited college or university 
• Five (5) years of experience in information security, cybersecurity, or related field 
• Five (5) years of experience in insider threat detection, behavioral analysis, or risk management 
• Experience with federal compliance frameworks including FISMA, NIST Cybersecurity Framework, and Risk Management Framework (RMF) 
• Knowledge of classified information handling procedures and National Industrial Security Program Operating Manual (NISPOM) requirements 
• Experience with security incident response and investigation methodologies 
• Demonstrated experience with security data analysis and threat intelligence platforms 
• Strong analytical and problem-solving skills with attention to detail 
• Excellent written and verbal communication skills

Desired Qualifications: 

• Experience with NOAA or other federal agency cybersecurity programs 
• Professional security certifications (CISSP, CISM, GIAC, or equivalent) 
• Experience with behavioral analytics and insider threat detection tools 
• Knowledge of NSPM-33 research security requirements 
• Familiarity with NIST Special Publications (SP 800 series) and federal cybersecurity guidance 
• Experience with Security Information and Event Management (SIEM) systems 
• Knowledge of machine learning and artificial intelligence applications in cybersecurity 
• Experience with cloud security frameworks and technologies 
• Understanding of privacy protection principles and compliance requirements