Senior Smart & SW Evaluator

By Common Criteria Pakistan, Ministry of Defense, Islamabad                                                                            Qualification: 

• PhD/MS in a relevant discipline of Computer Science or Computer Engineering or Electrical Engineering such as Cyber Security, Information Security, Network Security, Information Technology, Information Assurance, etc.

Experience:

• Minimum of twelve years’ experience of working in the versatile areas of information security evaluations at any relevant department, organization or agency at management positions.
• Knowledgeable of all relevant standards and publications pertaining to the specific tests (e.g. FIPS140-x, Common Criteria, PSS, Quantum and Post Quantum Cryptography NIST Publications, ISO27k, CIS-CAT benchmarking etc.) found on the lab’s scope.
• Professional Certifications in Cyber Security and Information Security such as CISSP, CISA, Common Criteria Certified Evaluator, ISO/IEC 27001 LA/LI, ISO/IEC 17025 LA would be a plus. 

Roles & Responsibilities:

• Supervise conduct of CC Evaluation activities.
• Maintains an ongoing dialogue with the director CC lab about the status and conduct of security assessments.
• Responsible for administration and technical activities of Screening and Evaluation Lab.
• Keep track of progress of screening and evaluation activities in the lab. Ensure that thorough, precise and comprehensive screening and evaluation reports are being prepared. Ensure that procedures for creating, storing, configuration management (CM), accessing, archiving and disposing of screening and evaluation activities records are being followed by teams. Observe and ensure that the highest standards of confidentiality for the information provided for screening and evaluation are being followed.
• Executes certification effort schedules and test methods in accordance with Pakistan CC Scheme and CC.
• Understands and complies with test methods and procedures. Reports details of all nonconforming work and supplies that prohibit the accurate conduct of security assessments (observation reports).
• Smart card’s security evaluation via tools and programming. Software security evaluation, vulnerability assessment and penetration testing via tools and techniques.