• Performs computer network defense (CND) incident triage, to include determining scope, urgency, and potential impact; identifying the specific vulnerability; and making recommendations that enable expeditious remediation.
• Installs, configures and supports cyber security tools such as Security Onion, McAfee Host Based Security Suite (HBSS), Assured Compliance Assessment Solution (ACAS), Security Event and Incident Management (SEIM).
• Ensures patches, hot fixes, system change packages and current AV definitions are applied and compliance verified.
• Surveys and evaluates network traffic and creates network diagrams.
• Determines baselines for network devices and host machines.
• Recognizes security events and takes appropriate action to identify threats and implement countermeasures.
• Analyzes captured network traffic using filters to identify anomalous traffic.
• Audits logs looking for anomalous actions and possible insider threats.

Conditions of employment

• Appointment may be subject to a suitability or fitness determination, as determined by a completed background investigation.
• Two year trial/probationary period may be required.
• Male applicants born after December 31, 1959, must complete a Pre-Employment Certification Statement for Selective Service Registration.
• This position may require the incumbent to take and successfully pass a Counterintelligence Scope Polygraph (CI/Poly).
• This position may require shift work to provide coverage on evenings, weekends, holidays, or special situations.
• Due to the nature of this position, employees may be required to work both planned and unscheduled overtime.
• The incumbent may be required to carry a cellular telephone and maintain a working personal telephone at all times.
• This position may be designated as Key. The position cannot be vacated during a national emergency or mobilization without seriously impairing the mission.
• This position may require the incumbent be able to obtain and maintain a determination of eligibility for a Secret or Top Secret security clearance or access for the duration of employment.
• This position requires the incumbent to obtain and maintain the appropriate Information Assurance certification in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, within 6 months of entry onto duty.
• This position may require a physical examination with a lifting requirement.
• The duties of this position may require the incumbent to possess or obtain and maintain a valid state Driver's License in one of the 50 U.S. states or possessions to operate vehicles.
• This position may require the incumbent to possess, or obtain and maintain, a valid regular or official U.S. Passport.
• This position MAY be eligible for situational telework only, including emergency and OPM prescribed "Unscheduled Telework".
• Service credit for annual leave accrual may be granted for certain non-Federal work experience and experience in the uniformed service.
• Student Loan Repayment MAY be authorized for highly qualified candidates.
• Recruitment or relocation incentives MAY be authorized for highly qualified candidates.
• Permanent Change of Station (PCS) allowances may be authorized, subject to the provisions of the Joint Travel Regulations and an agency determination that a PCS move is in the Government Interest.

Qualifications

Who May Apply: US Citizens

In order to qualify, you must meet the education and/or experience requirements described below. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community; student; social). You will receive credit for all qualifying experience, including volunteer experience. Your resume must clearly describe your relevant experience; if qualifying based on education, your transcripts will be required as part of your application. Additional information about transcripts is in this document.

Minimum Qualifications:
GS-05
Experience: Information technology related experience demonstrating each of the four competencies, as defined in the bottom of this section.
OR
Education: See "EDUCATION" section below.

GS-07
Specialized Experience: One year of specialized experience which includes monitoring network traffic and/or host processes to determine anomalies (such as monitoring the network via a network intrusion detection system (NIDS), monitoring host machines with host based intrusion detection system (HIDS), or using Security Information and Event Management (SIEM) tools). This definition of specialized experience is typical of work performed at the second lower grade/level position in the federal service (GS-07).
OR
Education: See "EDUCATION" section below.

GS-09
Specialized Experience: One year of specialized experience which includes performing configuration of network devices, host machines and/or servers (such as using a software product or scripting language to securely configure an initial network baseline, or build, install, or configure host images). This definition of specialized experience is typical of work performed at the second lower grade/level position in the federal service (GS-07).
OR
Education: See "EDUCATION" section below.

GS-11
Specialized Experience: One year of specialized experience which includes performing analysis to determine vulnerabilities on the network (such as analyzing network diagrams, scans of networks and hosts, interviewing stake holders, developing risk assessment matrixes, threat reporting, and emergency communications planning), and creating threat or vulnerability reporting based off analysis. This definition of specialized experience is typical of work performed at the second lower grade/level position in the federal service (GS-09).
OR
Education: See "EDUCATION" section below.

GS-12
Specialized Experience: One year of specialized experience which includes performing analysis in response to network (network devices, servers, hosts etc.) anomalies, intrusions, or security incidents (such as using the kill chain method to determine if an adversary is on the network, or determining system or permission misconfigurations), and creating threat, vulnerability, or correction reports. This definition of specialized experience is typical of work performed at the next lower grade/level position in the federal service (GS-11).

Applicants utilizing experience to qualify must have specialized experience that includes, or is supplemented by, information technology related experience (paid or unpaid experience and/or completion of specific, intensive training, as appropriate) which demonstrates each of the four competencies, as defined:

1. Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Examples include:
GS-05: completing work that sometimes requires editing by others, or requires review prior to completion.
GS-07/09/11: completing work independently that rarely requires editing or review by others.
GS-12: completing thorough and accurate work independently, even in the most difficult or stressful situations; occasionally reviewing work completed by others.

2. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Examples include: GS-05: resolving simple and routine problems, questions or complaints; asking appropriate questions to clarify information about issues, escalating non-routine issues to the appropriate individual, team, or organizational group; and responding to inquiries in a timely manner and keeping customers informed of status and status changes.
GS-07/09/11: resolving simple and routine problems, questions, or complaints and providing support and guidance to customers on non-routine issues; serving as a primary resource for customers, requesting assistance with complex issues when necessary; and participating in meetings and providing advice to customers in own area of expertise.
GS-12: resolving routine and non-routine problems, questions, or complaints; developing and maintaining strong, mutually supportive working relationships with customers; conducting evaluation of support to determine quality of services and customer satisfaction, and recommending procedural changes based on customer need or changes in policy and/or regulation.

3. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Examples include: GS-05: providing answers to routine inquiries in a clear, concise, and organized manner; actively listening to others, paying attention to verbal and non-verbal cues and listening for misunderstanding and misinterpretation.
GS-07/09/11: expressing facts and ideas in a clear, concise, convincing, and organized manner; clearly conveying moderately complex ideas, concepts, and information to customers; exhibiting active listening by demonstrating understanding of audience comments and/or questions.
GS-12: convincingly conveying complex information to customers; presenting thoughts that are well-organized and demonstrating confidence in the facts and ideas; adjusting style when working with individuals with different levels of understanding.

4. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendation. Examples include: GS-05: making routine decisions independently, where there is a standard process; identifying problems or inefficiencies in work processes and activities and recommending solutions; recognizing situations when further guidance is needed from senior colleagues or supervisors.
GS-07/09/11: identifying and solving problems by gathering and applying information from a variety of materials or sources that provide several alternatives; recognizing and taking action to address non-routine problems; soliciting feedback from multiple stakeholders to understand an issue or problem and accurately assess its root causes and potential solutions; seeking supervisory review where appropriate.
GS-12: solving complex or sensitive problems by developing and proposing strategic alternatives; identifying possible conflicts and shared benefits; helping team anticipate problems and identifying and evaluating potential sources of information; providing feedback and coaching to others to help solve problems; engaging appropriate stakeholders when developing solutions in order to understand and incorporate multiple perspectives and needs; evaluating the effectiveness of decisions and adjusting future decisions as appropriate.

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

Once the announcement has closed, a review of your application package (resume, supporting documents, and responses to the questionnaire) will be used to determine whether you meet the qualification requirements listed on this announcement. If, after reviewing your résumé and/or supporting documentation, a determination is made that you have inflated your qualifications and/or experience, you may lose consideration for this position. Please follow all instructions carefully when applying, errors or omissions may affect your eligibility.

You should list any relevant performance appraisals and incentive awards in your resume as that information may be taken into consideration during the selection process. If selected, you may be required to provide supporting documentation.

Veterans and Military Spouses will be considered along with all other candidates.

Interagency Career Transition Assistance Program (ICTAP). If you are a Federal employee in the competitive service and your agency has notified you in writing that you are a displaced employee eligible for ICTAP consideration, you may receive selection priority for this position. To receive selection priority, you must: (1) meet ICTAP eligibility criteria (2) be rated well-qualified for the position and; (3) submit the appropriate documentation to support your ICTAP eligibility. To be considered well-qualified and receive selection priority applicants must satisfy all qualification requirements for the position. Additional information about the program is on OPM's Career Transition Resources website.