Information Systems Security Engineer 3

First Tek, Inc.

Vancouver, WA

Apply

JOB DETAILS

SKILLS

Access Authorization, Adobe Flash, Analysis Skills, Application Programming Interface (API), Applications Security, Billing, Budgeting, Business Operations, Business Solutions, CISM - Certified Information Security Manager, Computer Hardware, Computer Networks, Computer Science, Computer Security, Computer Servers, Conferences, Consulting, Data Processing, Data Quality, Documentation, Driver's License, Electrical Engineering, Electrical Utility, Ergonomics, FISMA - Federal Information Security Management Act, Federal Contracts, Federal Laws and Regulations, First Aid, Government, Hand Tools, Hardware Architecture, Hazard Analysis, Hazardous Materials/Substances, High Availability, High Availability Software, High Voltage (HV), Identify Issues, Information Systems Security Engineering (ISSE), Information Technology & Information Systems, Information/Data Security (InfoSec), Internet Security, Interpret Regulations, JavaScript, Leadership, Maintain Compliance, Material Moving, Multiplatform/Cross-Platform, Negotiation Skills, Network Design, Network Security, Network Software, Network Support, Network Systems, On Site Support, Operational Control, Operational Support, Operations Control, Operations Management, Operations Planning, Operations Security (OPSEC), Organizational Development/Management, People Management, Performance Reviews, Policy Development, Procedure Development, Process Analysis, Process Hazard Analysis (PHA), Project Evaluation, Project Planning, Project/Program Management, Publications, Purchasing/Procurement, Regulations, Regulatory Compliance, Regulatory Submissions, Reimbursement, Resolve Customer Issues, Risk, Risk Analysis, Risk Management, Risk Management Framework (RMF), Safety Systems, Safety Training, Safety/Work Safety, Security Analysis, Security Architecture, Security Attacks, Security Equipment, Security Monitoring, Security Software, Seminars, Software Architecture, Software Design, Software Development, Software Patches, Staff Training, Standards Strategy, Statement of Work (SOW), Strategic Planning, Surveillance, System Operations, System Validation, Systems Administration/Management, Systems Analysis, Systems Maintenance, Technical Leadership, Technical Operations, Technical Support, Telecommunications, Test Plan/Schedule, Testing, Transmission Security (TRANSEC), U.S. National Institute of Standards and Technology (NIST), United States Department of Energy (DOE), User Interface/Experience (UI/UX), Vehicle Driving, Vendor/Supplier Selection, Willing to Travel, Work From Home

LOCATION

Vancouver, WA

POSTED

5 days ago

JS_ISSE3_API_20260708_CORA.docx

CFTE NON-CRAFT HIRING SAFETY TRAINING MATRIX

CONTRACT FULL TIME EQUIVALENT (CFTE)

NON-CRAFT HIRING SAFETY TRAINING MATRIX

Purpose:

The Contract Full Time Equivalent (CFTE) Hiring Safety Training Matrix is a hazard assessment for CFTE personnel routine tasks. It is intended to set a common understanding on training requirements between the CFTE personnel and the *** (BPA) managers/supervisors. BPA Requesting Managers should complete this form and coordinate with BPA Supplemental Labor Office during the procurement process to ensure the CFTE position includes a list of required trainings associated with identified tasks, conditions, and exposures. Each task, condition, and exposure indicate which training courses are required, who shall provide those trainings, and when those trainings shall occur.

This form is intended only as a reference document for contractors.

BPA Requesting Manager

(Last, First MI)

Ngo, Huy N

Date

05/29/2026

CFTE Job Title

ISSE3

Org

JS

PPE provided by Supplier or Contractor?

Yes No

If yes, list required PPE: White Hard Hat

Identify which Supplier or Contractor medical surveillance programs are required, if any*

Respirator User

Asbestos

Lead

Silica

Hearing Conservation

Other: Click or tap here to enter text.

No Medical Surveillance

*BPA Requesting Managers may use equivalent Job Title Position Hazard Assessments or project Job Hazard Analyses as indicators for which medical surveillance programs may be required. Direct any questions regarding medical surveillance program requirements to the BPA Industrial Hygienist, ***, or ***.

Instructions for BPA Requesting Manager: This template has been pre-populated with tasks and hazards generally associated with CFTE non-craft positions. BPA Requesting Managers must review this document during the CFTE procurement process. The BPA Requesting Manager will:

Select the checkbox next to each task/condition/exposure that may be encountered during the normal course of the assignment.

Identify if the mitigation for applicable tasks/conditions/exposures will be provided by BPA or the Contractor (supplier).

Indicate when the mitigation must occur (pre-hire, post-hire, pre-task).

Pre-Hire Training should be completed prior to the CFTE starting their assignment.

Post-Hire training should be completed prior to exposure to a hazardous environment and/or conducting work at a BPA worksite.

Pre-Task Training should be completed prior to conducting the associated task.

Once complete, the BPA Requesting Manager will send the completed document to the Supplemental Labor Management Office.

The listed tasks, conditions, and exposures are not all inclusive. New processes, unusual tasks, or equipment may trigger the need for specialized training. Consult with your local Safety Manager or BPA Safety Training Manager for guidance.

BPA provided safety training will be the same training provided to Federal Workers.

For the General Comments section, BPA Requesting Managers can list anything that was not already covered and provide clarification to the BPA COR to better understand the CFTE position. It may include tasks, conditions, and/or exposures that are unique to a particular position, work site, or person.

For more information on the PHA process/requirement, reference the Safety and Occupational Health Manual, Safety Management Systems Chapter.

Direct any questions regarding training requirements or issues related to this form to the BPA Safety Training Manager, ***, or ***.

Office & Remote Work/Telework Hazards

Task / Condition / Exposure

Required Training

Contractor (C) or BPA (B) Provided

Pre-Hire Training

Post-Hire Training

Pre-Task Training

Exposed to a fire in the building

BPA manager will advise of evacuation protocol and designated gathering location. Annual fire drills will be conducted.

B

Exposed to an earthquake while in the building

BPA manager will advise of evacuation protocol and designated gathering location.

B

Operating office tools (paper cutter, paper punch, staplers, etc.)

None Identified

B

Task / Condition / Exposure

Required Training

Contractor (C) or BPA (B) Provided

Pre-Hire Training

Post-Hire Training

Pre-Task Training

Performing tasks that may result in repetitive motion injuries, prolonged sitting and computer use

Optional: SUFS Move Safe (HRMIS 016633)

B

Ergonomics

Recognize the hazards and know when it is appropriate to stretch and take breaks; ensure a proper desk, chair, and equipment adjusted at the appropriate level; ensure proper lighting. Any ergonomic assessment to be provided by the supplier.

B

Performing tasks that may result in slips, trips or falls such as carrying boxes and walking on stairs or slick surfaces

Review SOHM Chapter 9

Choose an item.

Optional: Slips, Trips & Falls Training (HRMIS 015076)

Choose an item.

Adding electronic devices that were not previously part of the home (monitors, chargers, computing equipment, etc.)

None Identified. On-the-job familiarization (if using BPA-issued equipment).

Choose an item.

Travel / Field Operation Hazards

Task / Condition / Exposure

Required Training

Contractor (C) or BPA (B) Provided

Pre-Hire Training

Post-Hire Training

Pre-Task Training

Driving vehicles on public and/or non-public roads

Review SOHM Chapter 19

Choose an item.

Defensive/Distracted Driving (HRMIS 017057)

Choose an item.

Worker operates forklifts

Forklift Certification

Choose an item.

Worker operates a fire extinguisher

Fire Extinguisher Use

Choose an item.

Worker operates hand tools

None Identified

Choose an item.

Worker uses personal protective equipment

Personal Protective Equipment

Choose an item.

Worker may be exposed to shock and arc-flash hazard

Shock & Arc Flash Awareness

Choose an item.

Shock & Arc Flash Basic

Choose an item.

Shock & Arc Flash Advanced / Refresher

Choose an item.

Worker may contact but will not disturb Asbestos Containing Material (ACM) or Potentially Asbestos Containing Material (PACM) 2

Asbestos Awareness

Choose an item.

Worker required to work in remote areas where bear encounters may take place

Bear Pepper Spray Training

Choose an item.

Worker exposed to rodent and bird droppings1

Biological/Vermin/Hanta Virus

Choose an item.

Worker exposed to hot and/or cold environments

None Identified

Choose an item.

Task / Condition / Exposure

Required Training

Contractor (C) or BPA (B) Provided

Pre-Hire Training

Post-Hire Training

Pre-Task Training

Worker exposed to chemicals, such as herbicides or pesticides;

Herbicide Cert. Ref. 4-hr

Choose an item.

Herb Certification 8-hr

Choose an item.

Hazardous Communication

Choose an item.

Worker exposed to lead2

Lead Awareness

Choose an item.

Lead Worker Training

Choose an item.

Worker exposed to mercury

None Identified

Choose an item.

Worker exposed to noise2

Hearing Conservation (Initial)

Hearing Conservation (Annual)

Choose an item.

Worker exposed to silica2

Silica - Awareness

Choose an item.

Worker works at heights higher than 4

Fall Protection, Awareness

Choose an item.

Fall Protection, General

Choose an item.

Fall Protection, Advanced

Choose an item.

Ladder Safety

Choose an item.

Fall Protection, Advanced (TLM)

Choose an item.

Worker is required to take first aid and may be called on to render first aid for: workers on high voltage lines and/or equipment; worker works in remote areas

First Aid/CPR/AED

(Red Cross or AHA Accredited)

Required only if specified in the API

C

Worker performs work alone in remote areas

Wilderness Adv. First Aid

Choose an item.

Worker may prepare, transport or receive hazardous materials

DOT 1: Introduction, Classification, and the Hazardous Materials Table

DOT 2: Packaging, Labeling, Marking, and Placarding

DOT 3: Shipping Papers

DOT 4: Loading and Storage

DOT: Security for Shipment of Hazardous Materials

Hazardous Materials: Shipping Lithium Batteries under DOT Exemptions

DOT Hazardous Material Awareness for the General Hazmat Employee

Choose an item.

1 BPA workplace manager to review Hantavirus Prevention Procedure 420-240-1 before performing task.

2 These exposures may require enrollment in a Medical Surveillance Program. Ensure page 1 is marked accordingly.

Other Specific Hazards

Task / Condition / Exposure

Required Training

Contractor (C) or BPA (B) Provided

Pre-Hire Training

Post-Hire Training

Pre-Task Training

SAMPLE: Worker may make infrequent visits to field locations or substations

Worker complete the PPE assessment in the SOHM to determine need for PPE such as hard hat, safety glasses, hearing protection, safety vests, Arc Flash clothing or steel-toed boots.

B

X

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

Click or tap here to enter text.

Click or tap here to enter text.

Choose an item.

General Comments

BPA Requesting Manager Comments/Additional Considerations:

Click or tap here to enter text.

F_0139_HIRING_SAFETY_TRAINING_MATRIX_121624
*** | SUPPLEMENTAL LABOR MANAGEMENT OFFICE

ADDITIONAL PROCUREMENT INFORMATION (API)

Title & Level

Information System Security Engineer 3

Work Group Location

Vancouver, WA

Specialty

Infrastructure Security Architect Control Center

Sys-Cyber and Box

Offsite Work Eligibility*

Situational Telework

Organization

JS

Number of Days Onsite

5 days per Week

Hours

Full-Time, up to 40 hours

Additional Information

Enter additional info regarding the offsite work arrangement, if applicable.

Overtime

5% anticipated

On-Call

No

Travel

Up to 5% Local Travel

FN Status

NOT open to Foreign Nationals

* Current telework, remote work and onsite support is based on BPA s business needs and is subject to change or termination at any time.

** Assignments with the Remote Designation must reside in WA, OR, ID or MT. Case-by-case exceptions may apply only when in the best interest of BPA.

OVERVIEW

Assignment

This assignment is located in the OT Internal Business Operations (J), OT Cybersecurity (JS) organization, at ***. This position will assist BPA management in implementing, managing, operating, and maintaining mission critical systems that support the reliable and secure operations of BPA s grid operations as well as critical business applications. This assignment serves as a programmatic expert for the recommendation, development and implementation of operational cyber security and compliance strategies, standards, processes, guidelines, and projects to safeguard critical cyber assets that are necessary for reliable and secure operation of the assets used in the operation and control of the Bulk Electric System (BES).
The individual in this assignment will be one of the technical security experts and in collaboration with BPA management, will recommend and influence security and regulatory compliance for the most strategic and complex control center infrastructure systems and for the design, development and integration of large complex high availability, 24x7, multi-site, control center infrastructure systems, which are necessary for supporting grid operations. This assignment will also provide expert technical security advice, guidance, and recommendations to management and other technical specialists on critical control center infrastructure projects and management issues.
In addition, this assignment will isolate and identify unprecedented issues and unknown conditions; develops, tests, and advises on new technologies, methods, approaches, and guides; and will provide expertise and recommendations on project planning and policy-making functions covering a broad range of control center infrastructure projects. Serves as technical expert to agency management officials, including DOE, for security advice on integrating control center security programs with other key mission-critical Transmission Services programs.
This assignment will also review, analyze, and design solutions and implement management approved automated technical capabilities to verify that information security processes are practiced by BPA s control center information security practitioners, project managers, and system owners. Will apply new applications or developments to resolve unique or Client problems, conditions, or issues; significantly alter standard existing security practices, equipment, devices, processes, and known techniques; provide significant and innovative recommendations for advancing good security practices.

Organization

OT Cybersecurity (JS) organization is responsible for the architecture, strategy, design, implementation, monitoring, operation, regulatory compliance, and maintenance of BPA's Control Centers real-time control and data acquisition computers, control center network, infrastructure support equipment, and physical Operational Services.

ASSIGNMENT RESPONSIBILITIES

Note: All official drafts, documents and recommendations, as listed below, must be reviewed, finalized and approved / accepted by appropriate BPA manager or other federal personnel with the authority to do so.

Provide technical expertise on control center infrastructure security architecture and management for control center infrastructure systems and related matters.

Applies a broad knowledge of power system operations and associated control center systems including knowledge of security and regulatory (i.e. FISMA and NERC CIP) as it pertains to compliance computer networks, user interfaces, system software, data acquisition, telecommunications, substation field equipment, and related computer hardware areas.

Provide Information System Security Officer support and technical expert for the BPA control center General Support Systems and programs by providing expert technical advice, guidance, and recommendations to management and other technical and security specialists on critical operational issues relating to control center control infrastructure and data systems including the upgrade and enhancement of all systems in the two critical BPA control centers.

Recommend security strategies in the development of system, software and hardware architectures, technical plans and specifications, system designs, software designs, integration plans, test plans, and project plans.

Advises other IT experts and security practitioners throughout the control centers on a variety of situations and issues that involve applying or adapting new security technology theories, concepts, applications, standards, and/or practices.

As the control center infrastructure security architect and expert, serve as the project security/compliance lead, on assigned projects, for an interdisciplinary project team of electrical engineering and information technology staff assigned to execute on the most complex control center system projects.

Architect and design high availability infrastructures and applications to support current and future grid operations.

Verifies that the project plans conform to applicable organizational, agency and external security and compliance standards, policies and guidelines.

Provide technical expertise and assistance with the recommendation, development and implementation of BPA management-approved operational cyber security and compliance strategies, processes, guidelines, and projects to safeguard critical cyber assets.

Provide technical input, recommendations and assistance with the implementation of both higher and granular-level cyber security approaches, methods and solutions that incorporate and maintain compliance to requirements resulting from laws, regulations, or Presidential directives.

Develop / draft, recommend and execute BPA management-approved testing plans; report results and recommendations.

Provide security engineering expertise and recommendations.

In collaboration with the BPA manager and per established procedures, develop a cyber-security architecture for the BPA control centers to include accurate, comprehensive applicable documentation.

Perform detailed and comprehensive security event analysis.

Provide guidance and input in to technical reviews of proposed projects, and BPA s system security authorization processes.

Provide technical input and support to the Continuous Assessment and Monitoring Program.

Draft and recommend detailed project plans, timelines, milestones and objectives for upgrades, patches and other changes and/or for monitoring security measures for the protection of TT computer networks and information.

Perform risk assessments and execute tests of data processing system to validate functioning of data processing activities and security measures.

Validate appropriate security controls are in place that will safeguard digital files and vital electronic infrastructure.

Coordinate, facilitate and assist with general support systems and major applications security and compliance projects and program changes and initiatives that:

Are designed to anticipate, assess, and minimize system vulnerabilities and weaknesses;

Integrate across disciplines, platforms and internal organizations; (people, processes, systems).

Under the direction and leadership of BPA Management

Recommend the scope and level of detail for system security plans and collaborate and assist with draft policies, processes and procedures that are applicable to and promote Transmission Systems Operations security program.

Develop / draft long-range plans and strategies for IT security systems that anticipate, identify, evaluate, mitigate, and minimize risks associated with IT systems vulnerabilities.

Keep abreast of current and new security technologies and threats.

Identify the need or potential opportunity for changes based on new security technologies and threats; present recommendations and supportive data for consideration.

Research and review proposed new systems, networks, and software designs for potential security risks and impacts; recommend mitigation, countermeasures or other options.

Identify integration issues related to the implementation of new systems within the existing infrastructure; recommend mitigation and/or resolution options.

Provide subject matter expertise, technical guidance and assistance to other Security Control Assessors, Cyber Security personnel and Transmission Technology Operations (TTO) co-workers on a variety of ad hoc and standing projects requiring data / system process analysis.

Provide technical expertise, guidance and assistance to organizational co-workers with less experience, including cross-training as requested.

REQUIREMENTS

Education & Corresponding Experience (required on matrix)

Bachelor of Science in Computer Science, Information Technology or a directly related technical discipline is highly preferred.

With an applicable Bachelor s Degree, 15 years of experience is required

Without an applicable Bachelor s degree, 20 years of experience is required.

Experience must include the following:

Hands on technical implementation of networks and systems;

Experience evaluating various different technical, operational and management solutions to security problems, using written language and various media to present alternatives and recommendations;

Proven ability to develop documentation sufficient to arrive at logical and comprehensive conclusions and recommendations. The documentation must be of a sufficient professional level to stand as an artifact for reuse as part of the security architecture;

Experience evaluating the adequacy and existence of IT security controls as is conforms to security architectures.

Experience having properly documented evidence of security architecting, design and cyber-security activities sufficient for a third-party reviewer to arrive at the conclusion the Security control Assessor has reached in the work.

3+ years previous experience effectively performing security control implementation on networks, servers and systems and/or vulnerability assessments.

Required Technical Skills & Experience (required on matrix)

One or more of the following networking or security certifications:

Certified Information Systems Security Professional (CISSP)

Certified Information Systems Auditor (CISA)

Certified Information Security Manager (CISM)

5+ years of experience performing security control evaluation and testing.

8+ years of experience with North American Electric Reliability Corporation, Critical Infrastructure Protection (NERC CIP) regulatory standards and requirements.

10+ years of experience with the Risk Management Framework and the 800 series of National Institute of Standards & Technology (NIST) Special Publications (in particular 800-37, 800-39, 800-53, 800-53A, and 800-115);

Preferred Skills & Experience (optional on matrix)

Expert knowledge on FISMA controls

Expert knowledge on NERC-CIP standards

Understanding and experience in Federal electrical utility operations and how it interplays with FISMA/NERC-CIP standards and compliance.

Additional Requirements (not required on matrix)

Valid U.S. Driver s License is required.

First Aid/AED/CPR Certification required within 30 days of assignment start. Worker/Employer is responsible for maintaining current certification.

PPE Requirements

White Hard Hat

Attendance at all conferences, workshops, training, etc. must be pre-approved by SLMO. Requests will be reviewed on a case-by-case basis. Approval is subject to the most current guidance provided to SLMO by BPA or DOE and is subject to change at any time. SLMO reserves the right to negotiate attendance on billable/non-billable hours and reimbursement of travel costs with the supplier. Reimbursable travel costs must adhere to the Federal Travel Regulations and be submitted via an expense sheet in Fieldglass.

CLOSELY ASSOCIATED RESPONSIBILITIES & REQUIRED ASSOCIATED MITIGATION MEASURES

The following is a list of potential inherently governmental risk areas and the measures that SLMO-Compliance has determined must be in place, via processes and procedures, to mitigate the associated risks. The BPA manager s acceptance of the API or CWSD serves as their attestation that all applicable mitigation measures listed below are or will be established and adhered to in their organization.

Area of potential Closely Associated / Inherently Government function

Mitigation Measures

Access to Confidential / Sensitive Information

CFTE must sign NDA (Non-Disclosure Agreements) at beginning of assignments. (Does not apply to Craft assignments)

CFTE must complete annual Information Security and Privacy Awareness training.

CFTE must complete and pass background investigations of an appropriate level.

Acquisition Planning / Source Selection

CFTE are not permitted to serve as voting members for acquisition selections.

All purchasing decisions must be made by appropriate federal personnel (Contracting Officers).

All acquisition documents (requirements,
SOW s, evaluation criteria, etc.) must be reviewed, finalized and approved by appropriate BPA federal personnel.

Only Contracting Officers are authorized to obligate BPA funds.

Agency / Org Planning

All drafts, documents, materials and recommendations must be reviewed, finalized and approved by appropriate BPA federal personnel.

Budget / Finance Prep

Only Federal Employees may determine budget priorities & allocations.

BFTE must control and finalize / approve all budgets and related documentation, including that for projects, programs and Organizations.

Contract Management

All Contractual documents, including invoices must be finalized / approved by appropriate Federal personnel.

All contract-related decisions (modifications, changes, performance) must be determined by appropriate federal personnel (COs).

Decision Making

CFTE may provide input and recommendations to decision-makers.

Only appropriate federal personnel may make decisions which obligate BPA resources or to a specific course of action.

Direction & Control
(directing BFTE)

CFTE are not permitted to direct the actions of federal employees (BFTE) or have any control or input into their performance.

Work of BFTE must be assigned by federal manager, supervisor, Program / Resource manager or another appropriate designee.

Disposing Govt. Property

All decisions regarding the disposal of BPA property must be made by appropriate federal personnel; and all property dispositions must be directed and controlled by the Investment Recovery Center (IRC).

Dissemination of Agency/Policy Information / Training

All training and any information that is to be disseminated must be either 1) per established policy, process, procedure, or practice; or, 2) reviewed, finalized and approved by appropriate BPA federal personnel.

Inspection / IT Testing

Processes and procedures must ensure Federal personnel review inspection findings and CFTE recommendations before acceptance or rejection of material(s) / item(s).

HR Support

CFTE may assist with HR functions per established procedures, processes and guidelines (e.g., timekeeping).

All work products must be reviewed and finalized by appropriate federal employees.

Policy Development

BPA s process for Policy development includes multiple levels of federal review prior to acceptance / adoption.

Interpretation of Policy/Regulations

Only BPA federal employees may determine the applicability and interpretation of regulations.

CFTE are not permitted to interpret regulations for or on behalf of BPA. Regulations are interpreted by federal personnel and communicated via standards, guides, policies and processes.

Representing BPA

Contract workers are required to identify themselves and their employer in signature blocks, in introductions and have a nameplate outside their cubicle.

CFTE must receive written VP approval to represent BPA at outside events, such as workshops, seminars or conferences.

Page 4 of 4 F_0121_API_TEMPLATE_030626

About the Company

First Tek, Inc.

Resume Resources

Free Resume Templates Free Resume Builder