IT Specialist (INFOSEC), GS-2210-14, FPL GS-14 (Direct Hire)

Summary This position is in the U.S. Department of Education (ED), Federal Student Aid (FSA), Technology Directorate (TD). The Technology Directorate provides information technology services for all FSA systems, promoting the effective and secure use of technology to achieve FSA’s strategic objectives through sound planning, investments, integrated technology architectures and standards, effective systems development, production support, and cybersecurity services. Duties APPLICATION LIMIT: This vacancy announcement is limited to the first 200 applications received and will close at 11:59PM Eastern Time on the day that we receive the 200th application, or at 11:59PM Eastern Time on the listed closing date, whichever occurs first. We encourage you to read this entire vacancy announcement prior to submitting your application. We encourage you to read this entire vacancy announcement prior to submitting your application. As an Information Technology Specialist (INFOSEC), GS-2210-14, you will be responsible for: Serving as the Security Operations Center (SOC) incident response coordinator using tools like Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR)s, and ServiceNOW ticket system, leading the full LiveCycle of incident response, from detection through recovery, while coordinating containment and eradication efforts working with several partners, and continuously improving workflows and playbooks. Serving as the senior technical lead by coordinating Pen Testing, Red Team, and Purple Team exercises, the manager tests defenses against simulated attacks. This creates a feedback loop that continually strengthens detection capabilities and hones the team’s technical skills. Managing security vulnerabilities and detecting threats to uphold cyber hygiene, managing Continuous Diagnostics and Mitigation (CDM) security baselines. Reporting stakeholder communication and presenting through PowerPoint, MS Project, and other briefing tools to deliver daily SOC updates, incident findings, and enterprise security posture insights to executive leadership and non-technical stakeholders, including tailored presentations to the Chief Information (CISO) as needed. Requirements Conditions of employment You may be subject to serve a one-year probationary period. Must be a US Citizen Relocation will not be paid. Must complete a Background Investigation and Fingerprint check. Males 18 and over must be registered with the Selective Service. Condition of Employment: As a condition of employment for accepting this position, you may be required to serve a probationary period or trial period during which we will evaluate your fitness and whether your continued employment advances the public interest. In determining if your employment advances the public interest, we may consider: Your performance and conduct; The needs and interests of the agency; Whether your continued employment would advance organizational goals of the agency or the Government; and Whether your continued employment would advance the efficiency of the Federal service. Upon completion of your probationary period OR trial period your employment will be terminated unless you receive certification, in writing, that your continued employment advances the public interest. Selective Placement Factor (SPF): This position requires a CISSP or CISA professional certification in IT Security or IT Risk from a recognized, credentialed, professional association upon date of hire and acceptance of this position. You must meet all qualification requirements within 30 days of the closing date of this vacancy announcement. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills, and can provide valuable training and experience that translates directly to paid employment. We will consider all qualifying experience, including any volunteer experience. Qualifications Specialized Experience for the GS-14: One year of experience in either federal or non-federal service that is equivalent to at least a GS-13 performing two (2) out of three (3) of the following duties or work assignments: Experience coordinating Pen Testing, Red Team, and Purple Team exercises, testing defenses against simulated attacks, applying threat intelligence, and updating playbooks to continuously develop the SOC analytics capabilities. Experience in managing a SOC, leading advanced cyber incident triage and response efforts, including detection, investigation, containment, eradication, and recovery, for complex security events such as APTs and data exfiltration attempts, while documenting findings, ensuring alignment with Incident Response (IR) plans and NIST SP 800-61r2, improving SOC workflows, Standard Operating Procedures (SOP)s, and playbooks. Experience in conducting continuous, risk-based vulnerability management, overseeing cyber-hygiene and CDM scans to enforce enterprise-wide baseline security posture. Basic Experience Requirements:  You must possess IT related experience (paid or unpaid experience and/or completion of specific, intensive training (e.g., IT certification), as appropriate) demonstrating each of the four competencies listed below.  Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Customer Service - Works with clients and customers (i.e., any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Oral Communication - Expresses information (e.g., ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (e.g., technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. Knowledge, Skills, and Abilities (KSAs): The quality of your experience will be measured by the extent to which you possess the following knowledge, skills and abilities (KSAs). You do not need to provide separate narrative responses to these KSAs, as they will be measured by your responses to the occupational questionnaire (you may preview the occupational questionnaire by clicking the link at the end of the Evaluations section of this vacancy announcement). Knowledge of the Cyber Kill Chain, MITRE ATT&CK framework, and common attack methodologies. Expertise in SIEM, EDR, Web Application Firewall (WAF), forensics methodology, and threat intelligence. Knowledge of attacker frameworks (MITRE ATT&CK), the skill to hunt through complex data for hidden threats, and the ability to translate technical findings into business risk, and the ability to facilitate collaboration between Red and Blue teams. Skill in SIEM systems, EDR, including their configuration and optimization, expertise in forensics, pen testing, integrating threat intelligence feeds and managing cyber hygiene initiatives. Ability to communicate complex technical risks clearly to executive and non-technical audiences, think strategically about security operations to align them with business objectives, and apply strong root cause analysis to drive effective decision-making and continuous improvement. Education Education cannot be substituted for experience for this position and grade level.  Foreign Education: Education completed in foreign colleges or universities may be used to meet education requirements if you can show that the foreign education is comparable to that received in an accredited educational institution in the United States. It is your responsibility to provide such evidence when applying. If you are using foreign education to meet qualification requirements, you must submit a Certificate of Foreign Equivalency with your transcript in order to receive credit for that education.  For further information, please click Foreign Education. Additional information Veterans’ Career Counseling: If you are a veteran interested in receiving tips on preparing a Federal resume and/or how to prepare for an interview, you may email [email protected] to schedule a session with a career counselor (“Veterans Counseling Session” should be placed in the subject line of the email). Student Loan Default: If selected for this position, we will verify that you have not defaulted on any loan funded or guaranteed by the U.S. Department of Education. If you are found to be in default, we will contact you to make arrangements for repayment prior to making an official offer of employment. Suitability and Investigation: If selected for this position, you will be required to complete the Declaration for Federal Employment (OF-306) to determine your suitability for federal employment and successfully complete a pre-appointment investigation/background check. Essential/Non-Essential: This position is considered essential for purposes of reporting to work during federal government closures. Financial Disclosure: This position does not require financial disclosure. Bargaining Unit: This position is not included in the bargaining unit. Selections: Agencies have broad authority under law to hire from any appropriate source of eligibles and may fill a vacancy in the competitive service by any method authorized. We may make additional selections from this vacancy announcement within 90 days from the date the selection certificates are issued, should vacancies occur. We may also share selection certificates amongst program offices across the agency. Candidates should be committed to improving the efficiency of the Federal government, passionate about the ideals of our American republic, and committed to upholding the rule of law and the United States Constitution. Benefits A career with the U.S. government provides employees with a comprehensive benefits package. As a federal employee, you and your family will have access to a range of benefits that are designed to make your federal career very rewarding. Opens in a new windowLearn more about federal benefits. As an ED employee, you will also benefit from our family-friendly work environment. As part of our commitment to maintain a work life balance, we offer excused leave for Parent/Teacher Conferences (3 hours); excused leave for annual health screenings (4 hours); and matching leave for community volunteer service. Other flexibilities that may be available to you include alternative work schedules. You may be eligible to receive a recruitment incentive for this position. To receive this incentive payment, you will be required to sign a service agreement obligating you to remain with the U.S. Department of Education for a specified period as agreed upon. You may be eligible to receive a relocation incentive for this position. To receive this incentive payment, you will be required to sign a service agreement obligating you to remain with the U.S. Department of Education for a specified period as agreed upon. You may be eligible to participate in the Student Loan Repayment Program as a recruitment incentive for this position. To receive student loan repayments, you will be required to sign a service agreement obligating you to remain with the U.S. Department of Education for a specified period as agreed upon. Review our benefits Eligibility for benefits depends on the type of position you hold and whether your position is full-time, part-time or intermittent. Contact the hiring agency for more information on the specific benefits offered.