Clarification from the agency

US Citizenship or National (Residents of American Samoa and Swains Island).

Location of Position:  GSA, GSA IT.  This is full-time telework position.  Duty location will be determined upon selection.  

We are currently filling only one vacancy, but additional vacancies may be filled through this announcement in this or other GSA organizations within the same commuting area, as needed; through other means; or not at all.

This announcement covers the following positions/duties:

Position #1: Security Architect/Security Engineer

• Performs security reviews of GSA and government wide software applications/systems (on prem, cloud and hybrid) and approves proposed Security Architectures prior to the commencement of the system build (architecture, infrastructure, and code) to ensure that any proposed security architecture or proposed changes to an existing architecture are security designed and comply with GSA security requirements prior to implementation or redesign.
• Develop and maintain the security engineering framework and related process, and supporting procedural guides, technical guides and benchmarks that include, but not be limited to: system and cloud architecture, secure API integration, code quality, cryptography, and required key technical controls.

Position #2: AppSec SME/Security Engineer

• Responsible for maintaining the static application security testing tool and dynamic or interactive application security testing tool, working closely with system teams, DevSecOps teams and other internal teams to establish and improve the application security of GSA information systems at every stage of the development lifecycle. 
• Assist in onboarding system teams to the automated application security testing solutions. Support product and development teams in the area of application security, including defining abuse cases, misuse cases, threat modeling and architecture risk analysis, perform static and dynamic application security testing and code reviews and assist system teams in reproducing, triaging, and remediating application security vulnerabilities.

Position #3: ICAM SME

• Responsible for the governance of the Identity, Credential and Access Management (ICAM) Shared Services Portfolio.
• Manage the ICAM Program within the ICAM Shared Services Division, including development of any related policies, procedures, and processes.

Position #4:  Cyber Security Operations - Security Operations

• Manage the Bug Bounty Program and the Vulnerability Disclosure Program (VDP) to include drafting detailed vulnerability reports highlighting issues.
• Works with IT Security vendors to ensure their product roadmaps align with ongoing GSA strategic efforts.
• Responsible for a variety of Information Security tasks and functions to ensure agency-level compliance with GSA IT Security policies, Federal Information Security Management Act of 2002 (FISMA), Office of Management and Budget (OMD), Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) requirements.

Position #5:  Cyber Security Operations - Security Operations Center Product Owner

• Responsible for all internal security operations tasks and management of Security Operations Center, Incident Response, and Threat Hunt Function and the analyst staff associated with the SOC.
• Responsible for a variety of Information Security tasks. 
•  and functions to ensure agency-level compliance with GSA IT Security policies, Federal Information Security Management Act of 2002 (FISMA), Office of Management and Budget (OMB), Department of Homeland Security (DHS), and National Institute of Standards and Technology (NIST) requirements.
• Conducts, oversees and monitors security analyses, testing, evaluations and Certification and Accreditation (C&A) of systems and networks.
• Works with IT Security vendors to ensure their product roadmaps align with ongoing GSA strategic efforts in providing Security Operations as a Service model.

General: Leadership and Collaboration (ALL POSITIONS)

• Implements and provides authoritative advice and guidance to ensure the confidentiality, integrity, and availability of network and information systems.
  
• Collaborates with internal and external stakeholders and partners to support the government’s information security needs and establish related guidelines. Provides input and support of related high level initiatives.

NOTE: Current civil service employees will receive new appointments if selected under this Direct Hire Authority.

Conditions of employment

• You must be a U.S. Citizen.
• Relevant experience and/or education (as noted on the GSA website).
• Suitable for Federal employment, determined by a background investigation.
• You may be required to serve a trial period.
• You must apply on-line via the GSA website.

In order to be considered, you must meet the following conditions:

Qualifications

For each job on your resume, provide:

• the exact dates you held each job (from month/year to month/year)
• number of hours per week you worked (if part time).

If you have volunteered your service through a National Service program (e.g., Peace Corps, Americorps), we encourage you to apply and include this experience on your resume.
For a brief video on creating a Federal resume, click here.

The GS-14 base salary range starts at $111,521 (based on Step 1, outside of locality pay areas) to $176,300 (San Jose-San Francisco-Oakland, CA includes locality pay). Locality pay will be determined once the duty location has been established

If you are a new federal employee, your starting salary will likely be set at the Step 1 of the grade for which you are selected.

To qualify, you must have IT-related experience demonstrating EACH of the four competencies AND one year of specialized experience equivalent to the GS-13 level in the Federal service as described below:

IT SPECIALIST COMPETENCY REQUIREMENTS:

Attention to Detail - This skill is generally demonstrated by assignments where the applicant investigates and evaluates “state of the art” technology of the industry.
Customer Service - This skill is generally demonstrated by assignments where the applicant confers with users to evaluate the effectiveness of, or identify the need for, computer programs or management systems.
Oral Communication - This skill is generally demonstrated by assignments where the applicant persuades others to take a particular course of action or to accept findings, recommendations, changes, or alternative viewpoints.
Problem Solving - This skill is generally demonstrated by assignments where the applicant identifies and accommodates technology and resource constraints.

SPECIALIZED EXPERIENCE REQUIREMENTS:  Specialized experience is defined as experience leading IT security projects, providing information and recommendations to meet the business goals and improve processes of an organization’s IT security in one of the following areas:

• Experience in secure architecture design and review, threat modeling and technical guide development, and providing security engineering guidance and recommendations to meet the business goals and improve an organization’s IT security OR
• Experience in secure software development and application security (AppSec), managing SAST/DAST/IAST tools and assisting system teams in triage and remediation of software security vulnerabilities to improve the software security posture of the organization OR
• Experience in operationalizing an enterprise Identity, Credential, and Access Management (ICAM) program, including authentication mechanisms (e.g. SAML, OIDC) and access management solutions OR
• Experience in processing and validation of  vulnerability and conducting threat analysis to determine risk or Experience in Cyber Forensic and and Incident Response with the ability to lead a cyber incident
• Experience in maintaining a Security Operation Center for a Enterprise that include coordination with stakeholders and technical team

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

Applications will be evaluated for this job based on how well you meet the qualifications above.  You will be evaluated on the questions you answer during the application process, which will measure your overall possession of the following competencies or knowledge, skills, and abilities. Your responses to these questions must be supported by your resume or your score may be lowered. Qualified candidates will be considered in accordance with the Office of Personnel Management Direct Hire Guidelines. Veterans' Preference does not apply to the direct hire recruitment procedures. Certain selections made under this notice will be processed as new appointments to the civil service. Current civil service employees will be given new appointments to the civil service. You may not be considered for the position, if any part of the application is incomplete or missing the required supporting documentation. Falsifying your background, education and/or experience is cause for not hiring you or dismissing you if hired.

Position #1: Security Architect/Security Engineer

• Skills applying IT security theories, principles, concepts, standards, and best practices to understand the proposed IT system security design and guide the secure implementation of information systems.

Position #2: AppSec SME/Security Engineer

• Skill in applying application security and software security concepts, principles, methods, industry standards and practices to provide technical advice and guidance on critical application and software security issues.

Position #3: ICAM SME

• Skill in applying IT concepts, principles, methods, industry standards and practices to provide technical advice and guidance on critical IT issues  to apply new developments to special projects.

Position #4:  Cyber Security Operations - Security Operations

• Knowledge of Information Technology Security to apply experimental theories and developments to problems and make recommendations changing or developing  public policies or programs.
• Knowledge of the IT Security area of specialization, its governing laws, regulations, methodologies and/or policies to provide technical guidance on all issues related to the assigned program.
• Skill in applying a range of qualitative and/or quantitative methods for the assessment and improvement of Infosecurity (INFOSEC)  program effectiveness 

Position #5:  Cyber Security Operations - Security Operations Center Product Owner

• Knowledge of Information Technology Security to apply experimental theories and developments to problems and make recommendations changing or developing  public policies or programs.
• Knowledge of the IT Security area of specialization, its governing laws, regulations, methodologies and/or policies to provide technical guidance on all issues related to the assigned program.
• Skill in applying a range of qualitative and/or quantitative methods for the assessment and improvement of Infosecurity (INFOSEC)  program effectiveness.

General: Leadership and Collaboration (ALL POSITIONS)

• Skills in building relationships with internal and external customers to provide advice and guidance. 
• Knowledge of project management methodologies
• Ability to apply tools and technologies to direct the secure development and implementation of systems/software.