IT CYBERSECURITY SPECIALIST (INFOSEC)

Your tasks

NH03: This position serves as an Information System Security Officer (ISSO), supporting Risk Management Framework (RMF) execution for information systems through security control implementation and assessment, authorization package development, evidence collection, vulnerability tracking, Plan of Action and Milestones (POA&M) management, and continuous monitoring. Experienced in executing RMF activities for assigned information systems, applying cybersecurity principles, security controls, vulnerability management, continuous monitoring, and applicable federal, DoW, organizational, and Zero Trust requirements. Experienced in evaluating security control implementation and effectiveness; maintains authorization documentation; analyzes assessment evidence and findings; manages POA&Ms; and monitors security posture. Provides technical cybersecurity guidance and recommendations to system owners and stakeholders regarding security requirements, risks, controls, remediation, and authorization decisions. Experience in analyzing security documentation, vulnerability and configuration data, assessment findings, and system changes to identify security weaknesses, evaluate risk, and recommend remediation, mitigation, or compensation controls. Evaluates cybersecurity impacts of system changes and resolves or recommends solutions for complex issues involving vulnerabilities, control deficiencies, technical limitations, and competing mission and security requirements. Coordinates with technical stakeholders to validate remediation actions and security evidence and independently determines whether deficiencies have been adequately addressed. Evaluates cybersecurity practices and controls to identify gaps, risks, and improvement opportunities associated with Zero Trust, vulnerability management, continuous monitoring, and emerging cybersecurity requirements. Identifies recurring or systemic vulnerabilities and control weaknesses and recommends corrective actions or risk mitigation strategies. Develops technical analyses, risk assessments, metrics, reports, and briefings on system security posture, authorization status, vulnerabilities, remediation, and continuous monitoring results.

NH04: This position serves as a senior ISSM and cybersecurity technical authority for a portfolio of complex, high-profile enterprise systems, programs, and modernization initiatives. Establishes technical priorities and governance for RMF execution, security controls, authorization readiness, continuous monitoring, vulnerability management, and POA&M oversight. Interprets and applies federal, DoW, organizational, and emerging cyber security requirements to resolve complex issues and ensure consistent risk management across the portfolio. Integrates cybers security risk information across systems and programs to identify significant or systemic weaknesses and mission impacts. Reviews and validates significant control deficiencies, remediation strategies, compensating controls, cloud security, system interconnections, software assurance, and major system changes. Develops risk-management strategies and recommendations for complex issues extending beyond the individual system level and advises leadership on authorization, operational, acquisition, and risk decisions. Advises senior leadership, system owners, program managers, and technical officials on cyber security risk, authorization readiness, vulnerability priorities, Zero Trust, cloud security, modernization, and emerging requirements. Leads integration of cyber security requirements and risk considerations across engineering, acquisition, operations, and program organizations to resolve significant cross-functional issues. Presents executive-level risk analyses, metrics, trends, and recommendations addressing portfolio security posture, systemic risks, and issues affecting mission execution.

Requirements

Certifications: Positions require a current cybersecurity certification appropriate to the role and grade level in alignment with DoD 8140 cyber workforce requirements, such as Security+, CySA+, CASP+, CISSP, CISM, or an equivalent ISSO/ISSM qualifying certification.

All qualification and time-in-grade (if applicable) requirements must be met within 30 days of the closing date of this announcement. You must meet the minimum qualification requirements as stated in the Office of Personnel Management (OPM) Operating Manual, Qualification Standards for General Schedule Positions, http://www.opm.gov/qualifications/Standards/group-stds/gs-prof.asp.

Basic Requirement: Applicants must have IT-related experience demonstrating the following competencies appropriate to, or above, the level of this position. For vacancies below the full-performance level of the position, the basic requirement will be evaluated on a developmental basis. Your resume and work experience should clearly support your ability to meet these competencies and will be evaluated as part of the entire application process.

• Attention to Detail- experience reviewing my own information technology-related work or data and have been asked by others to review their work or data to ensure accuracy, completeness, and consistency with standards.
• Customer Service- experience maintaining relationships with customers, assessing current information technology needs of customers, and developing or identifying information technology products and services that are tailored to meet customer needs.
• Oral Communication- briefing mid-level management and IT staff on the status of information technology systems, projects, or daily operations, including the communication of technical information to a non-technical audience.
• Problem Solving- identifying alternatives to address complex information technology-related issues by gathering and applying information from a variety of sources that provide a number of potential solutions.

In addition to meeting the basic requirement, you must have one year specialized experience.

NH-03: You must have one year of specialized experience at the next lover broadband NH-02, equivalent to the GS-11 grade level or equivalent in other pay systems. Specialized experience must demonstrate support for RMF program support for information systems, including:

• Supporting RMF lifecycle activities, including categorization, control selection, control implementation, assessment preparation, authorization package development, and continuous monitoring.
• Familiarity with FedRAMP authorization, continuous monitoring, cloud security control implementation, shared responsibility models, and secure configuration practices for federal cloud environments.
• Preparing, reviewing, and maintaining RMF artifacts, including System Security Plans, control implementation statements, Security Assessment Reports, POA&Ms, risk acceptance documentation, assessment artifacts, and continuous monitoring records.
• Analyzing vulnerability scan results, configuration compliance data, audit findings, system changes, and assessment results to identify risk, support remediation, validate closure evidence, and document compensating controls.
• Practical understanding of Zero Trust architecture initiatives across ICAM, device compliance, network segmentation, application security, data, protection, telemetry, and automation pillars.

NH-04: One year of specialized experience at the next lower broadband NH-03, equivalent to the GS-13 grade level or equivalent in other pay systems. Specialized experience must demonstrate leadership or advisory responsibility for RMF program execution for complex, high-visibility, or enterprise information systems, including:

• Preparing, reviewing, and approving organizational cybersecurity and RMF policies, directives, procedures, and instructions to ensure alignment with federal, DoD, and organizational security requirements.
• Leading RMF planning, authorization readiness, control implementation reviews, assessment coordination, continuous monitoring, POA&M governance, risk acceptance analysis, and development of risk recommendations for leadership.
• Reviewing and validating authorization packages, security control evidence, vulnerability remediation strategies, cloud security responsibilities, system interconnections, software assurance results, and major system changes to determine cybersecurity risk and mission impact.
• Advising system owners, program managers, technical teams, assessors, contractors, and leadership on RMF execution, documentation quality, control implementation, audit readiness, vulnerability prioritization, Zero Trust alignment, and secure system lifecycle requirements.
• Leading cross-functional coordination across acquisition, engineering, operations, security, and executive stakeholders to resolve cybersecurity risks, support authorization decisions, maintain continuous monitoring visibility, and align RMF activities with mission priorities.

Education is not substitutable for specialized experience for this grade level.

ARE YOU USING YOUR EDUCATION TO QUALIFY? If the position you are applying for has a positive degree requirement or education forms the basis for qualifications, you MUST submit transcripts with your application. Official transcripts are not required at the time of application; however, if position has a positive degree requirement, qualifying based on education alone or in combination with experience; transcripts must be verified prior to appointment. An accrediting institution recognized by the U.S. Department of Education must accredit education. Click here to check accreditation.

FOREIGN EDUCATION: Education completed in foreign colleges or universities may be used to meet the requirements. You must show proof the education credentials have been deemed to be at least equivalent to that gained in conventional U.S. education program. It is your responsibility to provide such evidence when applying.

Other

This position is under the DoW Acquisition Workforce Personnel Demonstration Project (AcqDemo) within Title 5 Competitive Service. For more information on Acq Demo please go to the DoW AcqDemo website at https://acqdemo.hci.mil/ and Fact Sheet at https://acqdemo.hci.mil/faq.html Purpose of NH-3: Serves as an Information Systems Security Officer. Purpose of NH-4: Serves as a senior ISSM and principal cybersecurity technical authority.

PART-TIME OR UNPAID EXPERIENCE: Credit will be given for appropriate unpaid and or part-time work. You must clearly identify the duties and responsibilities in each position held and the total number of hours per week.

VOLUNTEER WORK EXPERIENCE: Refers to paid and unpaid experience, including volunteer work done through National Service Programs (i.e., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community; student and social). Volunteer work helps build critical competencies, knowledge and skills that can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.