DHS Chemical Security Inspector Job Openings

The USAJobs.gov web site is listing openings for CFATS Chemical Security Inspectors. The current announcement opened on Monday and will remain open thru May 16th. According to this job listing there are positions open in Chicago, Los Angeles, Houston, Buffalo, Newark, and Philadelphia.

While anyone that is considering becoming a CSI (I love that acronym being a fan of the TV shows) should certainly visit this web site, I think that it would be eye opening for anyone involved in the CFATS program to look at the type of person that DHS is looking for to fill these important positions.

Competencies

In addition to specific background requirements DHS will be evaluating applications against the following list of competencies:

• Knowledge of security system methods pertaining to the characteristics, manufacturing process and transportation of hazardous and high risk chemicals;

• Ability to perform chemical security inspections under the chemical facility anti-terrorism standards (CFATS);

• Ability to perform enforcement operations under the chemical facility anti-terrorism standards (CFATS);

• Knowledge of the laws, regulations and principles pertaining to chemical security inspections;

• Knowledge of analytical and evaluative methods used in information gathering and protection programs;

• Ability to liaise effectively with representatives of other organizations (ex: federal agencies, state, local and tribal government officials, and/or private sector officials);

• Ability to communicate effectively orally; and

• Ability to communicate effectively in writing

You’ll notice that there is nothing in the list that addresses cyber security background. Realistically, I doubt that CFATS inspectors are spending much time looking at cyber security beyond the very basics of IT security issues. The issues related to control system security are just too complex to expect CSI to have the necessary background and training in addition to the other security training and chemical safety knowledge that the inspectors must possess.

Conditions of Employment

Another area that personnel at CFATS facilities ought to look at before the CSI appear on site is the section of the job opening notice that details the conditions of employment. Understanding what these inspectors have to put up with might make it easier to take some of the inevitable brusqueness that one encounters with many people in these kinds of positions. The notice lists the following conditions of employment:

• Candidates are required to participate in medical monitoring.

• Candidates must obtain and maintain a valid State Driver's License.

• Candidates will be required to perform certain essential duties in close proximity to large quantities of the most hazardous chemicals and chemical production processes in the world under all weather conditions.

• Medical qualifications are required for Hazardous Materials Technician Certifications.

Administratively Uncontrollable Overtime Pay (AUO) may be authorized.

• Frequent and often unscheduled travel (50% of the time) may be required within your geographical area of operation or anywhere else in the US or its associated territories as required by DHS HQ.

• Candidates will be required to attend and successfully complete the multi-week Chemical Security Academy training.

• Candidates will be required to file an OGE 450 Confidential Financial Disclosure Report annually.

• Candidates must sign a Mobility Agreement.

Reader Comment – ISCD ICS Expertise

I like reader comments that start out ‘good points, but…’ and then go on to suggest additional point that I may have missed. One of those was posted to yesterday’s post on the SHODAN search engine by an anonymous reader. It’s well worth reading, but I would like to take a closer look at the first comment made by Anonymous. In response to my comments about DHS ISCD using SHODAN as part of their facility inspection process Anonymous wrote:

“However, as for ISCD not having the manpower or skill sets to do Shodan...well, that's just plain scary, imho.”

In many ways I have to agree with Anonymous, and I need to make it clear that I have not met a single chemical facility inspector yet and I have not had a chance to take a detailed look at the training that they receive in the Chemical Security Academy, so I am making some assumptions about the skills that they may or may not have. Having said that, I still think that they are reasonable assumptions for the reasons I’ll explain below.

Chemical Security Inspectors

First the Infrastructure Security Compliance Division has had to create an inspection force from scratch. Before CFATS there was no such profession as Chemical Security Inspector, so they could not hire such people off the street. So ISCD had to hire people with a general security background and then train them on the security issues specific to the chemical industry. Not only that, but to have these people walking around chemical facilities, they had to train them in the very real personal safety issues that can arise in such facilities. And they had to train them in the CFATS regulations, including the very real restriction that DHS could not require facilities to use any specific security measure.

Chemical Security Inspectors are going to be expected to take a detailed look at a wide range of security issues. First there are all of the standard physical security measures; perimeter barriers and detection systems, video surveillance, vehicle and personnel entry control systems and procedures, internal restricted area systems and procedures, improvised explosives detection and blast protection. Then there are the loss prevention measures including inventory control, order processing and customer vetting. Add in personnel surety measures, vetting and verification of training, records and maintenance management issues. And, oh yes, they must be familiar with cyber security issues for both standard IT systems and industrial control systems.

Then there are the chemical specific issues that these inspectors must understand. First they must be able to identify and understand the chemical hazards associated with almost 200 specific chemicals of interest. They are also going to have to understand the basic physical and chemical processes that are used to manufacture these chemicals or in which these chemicals are used including the process safety systems employed to protect these chemicals. They are going to have to understand the physical protection of storage, internal transport, loading/unloading, and off-site transportation systems related to the chemicals of interest.

Finally, these inspectors are going to be going into almost every type of industrial setting imaginable. The almost 200 chemicals of interest are manufactured in chemical facilities (and most people have no idea of how many different types of chemical manufacturing processes there are), but they are used in almost every type of industry you can think of and some are even sold in publicly accessible commercial establishments.

How much do these inspectors need to know about all of these areas? Well, the inspections that these folks are doing aren’t the typical three-hour compliance visits one gets from OSHA or EPA. These five day inspections look at the systems in a level of detail usually only seen when an OSHA team comes in after a major accident causes a death at a facility.

Finally, until just recently, most people in the chemical industry (actually most manufacturing industries) thought that the only vulnerability they really had to worry about with their control systems was keeping the IT people away from their systems. Their control systems were just so complex, specialized and isolated that there was no way that they were going to be attacked. So there is not a lot of security expertise in the control system community in general and less so in the chemical process community.

One last thing to consider; there are about 200 Chemical Security Inspectors with the responsibility for inspecting almost 6,000 high-risk chemical facilities. So there is not going to be a lot of room for specialization.

So, that is why I suspect that the ISCD folks may not have the people or skill sets necessary to do the SHODAN searches for vulnerable control systems at high-risk chemical facilities. I’m not finger pointing; they are just trying to do too much with too few folks (are you listening Congress?).

ICS Security Expertise

This is not a problem unique to the chemical processing industry. DHS has made a big thing of trying to hire 1,000 cyber security experts, but most of those are going to look at the protection of information processing systems, not control systems. The only Federal agency that is really looking at control system issues is ICS-CERT and that is a relatively small organization.

An example of how bad this problem is can be found in a recent blog posting over at Symantec.com. Symantec has been having problems finding people with ‘verifiable’ expertise in STL coding to help them continue their work on the Stuxnet worm. If Symantec is having problems what kind of issue is ICS-CERT going to have in expanding their operations, something that is obviously going to be necessary as it becomes more obvious that there is a real potential threat to control systems.

Expanding the number of control system security experts is going to have to be a high priority for control system venders, the control system user community, and the government. The size of the problem makes it a near certainty that it will take some sort of Federal intervention to make this happen. Unfortunately, there has been very little mention of control system security issues in the recent discussions of cyber security in Congress.

Unfortunately, there will be little incentive for anyone to spend the requisite money for developing the education and training programs necessary to produce the number of ICS security experts. After all, there have been no real attacks (other than begrudged insiders) on control systems, so why should anyone spend serious money to protect them. So we can expect the politicians to be blind to this issue until there is a clearly verifiable attack on a US chemical facility. But then it will be too late; it takes time to train security professionals, especially control system security professionals.

Chemical Security Inspector Opening

I’m a little late in finding this job listing, but it does remain open until 03-25-10. DHS has posted a “few vacancies” for Chemical Security Inspectors on USAJobs.gov. I didn’t find a series of openings like I did the last time. I saw a similar listing on FederalGovernmentJobs.us, but that is not official site for applying for these jobs, so I would stay away from that site.

Hiring Chemical Security Inspectors

The USAJobs.gov web site has the latest listing for Chemical Security Inspectors. Openings are listed in Seattle, WA; Denver, CO; St Louis, MO; Chicago, IL; Boston, MA; Los Angeles, CA; Houston, TX; Newark, NJ; Philadelphia, PA; and Atlanta, GA. This set of job postings opened on January 4h and will close on January 15th.

Reading the ‘Major Duties’ and ‘Conditions of Employment’ sections of the listing is very interesting. For example: “Frequent and often unscheduled travel (50% of the time) may be required.” I’m surprised that they only figure 50% travel; I would have guessed 75% with the number of facilities and the expected number of inspectors.

BTW: I understand that DHS will accept and consider applications from previous applicants.

DHS Hiring Situation

I have been receiving a number of emails from readers with questions about the DHS hiring process. They had seen DHS inspector jobs listed on USAJOBS.gov and submitted their applications. They had been through various stages of the application process and been told that they would be notified in 4 to 5 weeks of the status of their application. They hadn’t heard anything and wanted to know if I had heard anything about delays in the hiring process. 

Now, I obviously cannot check up on individual job applications. The application process has a number of checks and balances worked into the process to ensure the privacy of the applicants. There may be someone in the DHS HR process that could run down individual application status, but I certainly don’t know that person. Even if I did, I would be hard pressed to come up with a legitimate reason for that person to violate DHS and government rules to give me access to personal information on job applicants. And to be fair, none of the readers have asked for specific information about their particular job application. 

So here is what I do know about the situation for DHS and the hiring of chemical security inspectors. First, DHS was given specific authorization in the DHS appropriations bill to increase the number of their authorized full time personnel in order to expand the number of chemical security inspectors. Part of position increase was set for fiscal year (FY) 2010 and more was authorized for FY 2011. It is likely that the new chemical facility security legislation that will probably pass sometime next year will include authorization (but not necessarily appropriations) for some additional inspectors over that number. 

DHS will be having their next Chemical Security Academy (CSA) class in January. The people who will be attending that class have been selected and should have been notified of that selection, sometime before Thanksgiving. If you had completed interviews before Thanksgiving and have not received notification of selection, you were most likely not selected. I would like to think that DHS has a non-selection notification process, but with recent experience in the job search process I know that such a non-selection notification is very rare. 

I have been told by a very reliable source that DHS has announced their next round of hiring on that site, but a quick check today on www.USAJobs.gov did not show any chemical security positions in DHS NPPD. That application period may, however, be over. I don’t know what the class date for that announcement is, but I am sure that once that round is completed, filling the next CSA class, DHS will be starting the next round of the hiring process. It would seem reasonable to assume that the hiring process is now limited by the number of slots for the CSA. 

Most job offers attract multiple applications. In today’s economy the number of applicants is very high, giving DHS a large number of quality applicants to choose from (and an even higher number of unqualified applicants to screen out). If you don’t get hired on your first application; and you did at least get an interview, by all means apply again for the next round. As I have told each of the readers who have asked, persistence must count for something.