Goal templates — Security Engineering — P2

Security · Security Engineering · P2 — Developing Professional

These are canon-derived frames, not advice: every line is either verbatim JobFrame canon text or a fixed template wrapping it. ⟨target⟩ / ⟨baseline⟩ / ⟨date⟩ are placeholders for the manager to fill in. Nothing here is generated by AI — rows are omitted, never invented, when the canon lacks the underlying field.

SMART goals

One row per canon core output / responsibility this level owns.

JFM responsibility (P2)

Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures

Specific: Deliver: "Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"
Measurable: Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
Achievable: Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
Relevant: Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
Time-bound: ⟨date⟩

JFM responsibility (P2)

Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL

Specific: Deliver: "Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"
Measurable: Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
Achievable: Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
Relevant: Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
Time-bound: ⟨date⟩

JFM responsibility (P2)

Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners

Specific: Deliver: "Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"
Measurable: Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
Achievable: Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
Relevant: Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
Time-bound: ⟨date⟩

JFM responsibility (P2)

Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic

Specific: Deliver: "Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"
Measurable: Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
Achievable: Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
Relevant: Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
Time-bound: ⟨date⟩

JFM responsibility (P2)

Contributes to drafting and updating security policies and supports delivery of security awareness training programs

Specific: Deliver: "Contributes to drafting and updating security policies and supports delivery of security awareness training programs"
Measurable: Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
Achievable: Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
Relevant: Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
Time-bound: ⟨date⟩

Copy / print as textshow ▾

1. Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures  [source: JFM responsibility (P2)]
   Specific:    Deliver: "Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"
   Measurable:  Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
   Achievable:  Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
   Relevant:    Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
   Time-bound:  ⟨date⟩

2. Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL  [source: JFM responsibility (P2)]
   Specific:    Deliver: "Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"
   Measurable:  Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
   Achievable:  Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
   Relevant:    Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
   Time-bound:  ⟨date⟩

3. Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners  [source: JFM responsibility (P2)]
   Specific:    Deliver: "Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"
   Measurable:  Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
   Achievable:  Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
   Relevant:    Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
   Time-bound:  ⟨date⟩

4. Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic  [source: JFM responsibility (P2)]
   Specific:    Deliver: "Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"
   Measurable:  Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
   Achievable:  Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
   Relevant:    Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
   Time-bound:  ⟨date⟩

5. Contributes to drafting and updating security policies and supports delivery of security awareness training programs  [source: JFM responsibility (P2)]
   Specific:    Deliver: "Contributes to drafting and updating security policies and supports delivery of security awareness training programs"
   Measurable:  Move the metric this drives from ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩.
   Achievable:  Scoped to this level's jfm complexity/problem-solving rubric: "Solves moderately complex security problems by applying defined procedures and some routine independent analysis."
   Relevant:    Advances the Security · Security Engineering mandate for a P2 — Developing Professional.
   Time-bound:  ⟨date⟩

OKRs

Objectives from this level's core outputs; key results only where a real dimension or capability backs them.

JFM responsibility (P2)

Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures

From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"
Evidence at this level's scope bar: "Defined deliverables / small features" — ⟨target⟩ by ⟨date⟩

JFM responsibility (P2)

Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL

From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"
Evidence at this level's autonomy bar: "General supervision; reviewed at milestones" — ⟨target⟩ by ⟨date⟩

JFM responsibility (P2)

Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners

From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"
Evidence at this level's complexity bar: "Some non-routine problems; applies established patterns" — ⟨target⟩ by ⟨date⟩

JFM responsibility (P2)

Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic

From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"
Evidence at this level's impact bar: "Own and immediate-team deliverables" — ⟨target⟩ by ⟨date⟩

JFM responsibility (P2)

Contributes to drafting and updating security policies and supports delivery of security awareness training programs

From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Contributes to drafting and updating security policies and supports delivery of security awareness training programs"
Evidence at this level's decision rights bar: "Routine technical choices within guidance" — ⟨target⟩ by ⟨date⟩

Copy / print as textshow ▾

Objective 1: Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures  [source: JFM responsibility (P2)]
  KR1. From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"
  KR2. Evidence at this level's scope bar: "Defined deliverables / small features" — ⟨target⟩ by ⟨date⟩

Objective 2: Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL  [source: JFM responsibility (P2)]
  KR1. From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"
  KR2. Evidence at this level's autonomy bar: "General supervision; reviewed at milestones" — ⟨target⟩ by ⟨date⟩

Objective 3: Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners  [source: JFM responsibility (P2)]
  KR1. From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"
  KR2. Evidence at this level's complexity bar: "Some non-routine problems; applies established patterns" — ⟨target⟩ by ⟨date⟩

Objective 4: Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic  [source: JFM responsibility (P2)]
  KR1. From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"
  KR2. Evidence at this level's impact bar: "Own and immediate-team deliverables" — ⟨target⟩ by ⟨date⟩

Objective 5: Contributes to drafting and updating security policies and supports delivery of security awareness training programs  [source: JFM responsibility (P2)]
  KR1. From ⟨baseline⟩ to ⟨target⟩ by ⟨date⟩ — tied to: "Contributes to drafting and updating security policies and supports delivery of security awareness training programs"
  KR2. Evidence at this level's decision rights bar: "Routine technical choices within guidance" — ⟨target⟩ by ⟨date⟩

MBO areas

Key result areas from this level's responsibilities, each with a standard grounded in the canon leveling rubric where one exists.

Area	Standard	Target	Due
Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures	Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."	⟨target⟩	⟨date⟩
Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL	Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."	⟨target⟩	⟨date⟩
Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners	Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."	⟨target⟩	⟨date⟩
Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic	Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."	⟨target⟩	⟨date⟩
Contributes to drafting and updating security policies and supports delivery of security awareness training programs	Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."	⟨target⟩	⟨date⟩

Copy / print as textshow ▾

1. Area: Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures  [source: JFM responsibility (P2) — reused, no distinct responsibility content]
   Standard: Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."
   Target:   ⟨target⟩   Due: ⟨date⟩

2. Area: Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL  [source: JFM responsibility (P2) — reused, no distinct responsibility content]
   Standard: Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."
   Target:   ⟨target⟩   Due: ⟨date⟩

3. Area: Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners  [source: JFM responsibility (P2) — reused, no distinct responsibility content]
   Standard: Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."
   Target:   ⟨target⟩   Due: ⟨date⟩

4. Area: Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic  [source: JFM responsibility (P2) — reused, no distinct responsibility content]
   Standard: Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."
   Target:   ⟨target⟩   Due: ⟨date⟩

5. Area: Contributes to drafting and updating security policies and supports delivery of security awareness training programs  [source: JFM responsibility (P2) — reused, no distinct responsibility content]
   Standard: Consistent with this level's jfm knowledge-application rubric: "Applies working knowledge of detection logic, scripting, and vulnerability assessment to conventional tasks, exercising judgment in familiar contexts."
   Target:   ⟨target⟩   Due: ⟨date⟩

Scorecard

Only perspectives with real canon backing are shown — no Financial or Customer perspective, since nothing in the canon grounds business-financial or customer measures for a role alone.

Internal process

"Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"→ ⟨target⟩ by ⟨date⟩
"Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"→ ⟨target⟩ by ⟨date⟩
"Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"→ ⟨target⟩ by ⟨date⟩
"Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"→ ⟨target⟩ by ⟨date⟩
"Contributes to drafting and updating security policies and supports delivery of security awareness training programs"→ ⟨target⟩ by ⟨date⟩

Role calibration

Meets the scope bar: "Defined deliverables / small features"→ ⟨target⟩ by ⟨date⟩
Meets the autonomy bar: "General supervision; reviewed at milestones"→ ⟨target⟩ by ⟨date⟩
Meets the complexity bar: "Some non-routine problems; applies established patterns"→ ⟨target⟩ by ⟨date⟩
Meets the impact bar: "Own and immediate-team deliverables"→ ⟨target⟩ by ⟨date⟩
Meets the decision rights bar: "Routine technical choices within guidance"→ ⟨target⟩ by ⟨date⟩
Meets the leadership bar: "May guide interns"→ ⟨target⟩ by ⟨date⟩

Copy / print as textshow ▾

Internal process
  - "Independently manages defined security protocols and analyzes risks within familiar systems, implementing security measures per established procedures"  →  ⟨target⟩ by ⟨date⟩   [source: JFM responsibility (P2)]
  - "Writes and maintains basic detection logic and automation scripts in Python or Bash to reduce repetitive triage and monitoring tasks, querying log data with SQL"  →  ⟨target⟩ by ⟨date⟩   [source: JFM responsibility (P2)]
  - "Conducts vulnerability assessments and contributes findings to remediation plans, partnering with system owners"  →  ⟨target⟩ by ⟨date⟩   [source: JFM responsibility (P2)]
  - "Participates in incident response and recovery efforts, owning containment steps for assigned incidents and using Wireshark to inspect suspicious network traffic"  →  ⟨target⟩ by ⟨date⟩   [source: JFM responsibility (P2)]
  - "Contributes to drafting and updating security policies and supports delivery of security awareness training programs"  →  ⟨target⟩ by ⟨date⟩   [source: JFM responsibility (P2)]

Role calibration
  - Meets the scope bar: "Defined deliverables / small features"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Scope)]
  - Meets the autonomy bar: "General supervision; reviewed at milestones"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Autonomy)]
  - Meets the complexity bar: "Some non-routine problems; applies established patterns"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Complexity)]
  - Meets the impact bar: "Own and immediate-team deliverables"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Impact)]
  - Meets the decision rights bar: "Routine technical choices within guidance"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Decision rights)]
  - Meets the leadership bar: "May guide interns"  →  ⟨target⟩ by ⟨date⟩   [source: level dimension (Leadership)]