Clarification from the agency

Open to current permanent ODNI employees

The Cybersecurity Group (CSG) oversees IC-wide efforts to safeguard the Intelligence Community (IC) Information Environment (IC IE) in support of the DNI's Title 44 statutory responsibilities. With a focus on security aspects of the IC IE, CSG utilizes proactive oversight and management levels of governance, policy, standards, architecture, engineering, risk management, testing investment, and reporting to drive a secure, robust, and integrated IC IE aligned with IC mission-related objectives and strategies. The Director of CSG is dual-hatted as the IC Chief Information Security Officer (IC CISO).

Supports the Chief of Risk Management in the oversight, direction and professional development of its assigned staff, and contract personnel. Supports the development, management and execution of the Risk Management Division's organizational goals, objectives and authorized budget.

Serve as Lead, Cloud Cybersecurity Assessment and Reporting Team within the Risk Management Division (RMD), Cybersecurity Group, leading the execution, documentation, and authorization processes necessary to assure that new and current commercial cloud enterprise (C2E) service providers meet Information Assurance requirements as a service of common concern (SoCC) for the IC.

Enables the IC Mission through the effective execution of the Risk Management Framework (RMF) and the application of adequate security controls across the C2E of the IC IE.

Ensures that the appropriate management and operational security posture is maintained for information systems.

Serves as a principal advisor on all cloud information system security matters and is a subject matter expert in applying ICD 503, CNSS 1253, and NIST SP 800-53.

Executes functions that include; info security policy interpretation, reviewing security control assessments, providing briefings and presentations to senior audiences, negotiating among different parties, formulating positions across a wide range of cybersecurity issues.

Provides senior level analysis and review of risk considerations (mission, security, and costs tradeoffs) in context of IC missions, interpreting Security Assessment Reports (SARs), Risk assessment Reports (RARs), providing critical thinking in applying security controls to system design and risk determinations.

Performs and provides risk tradeoff analysis to implement the policies, processes, models, assessments, and standards needed to recommend risk acceptance authorization for complex systems and mission enablement.

Define and develop information security requirements and engineering solutions for new systems and plan, define, and review system security plans.

Directly support more senior security managers charged with developing security guidelines for the IC and ensuring that security processes are compliant with appropriate federal requirements.

Provides the information system owners detailed and constructive recommendations for correction, along with references to appropriate government regulations and explanations and desired specific outcome(s) of the corrections.

Conducts activities and works with government personnel, supervisors, contractors, and liaise with other government agencies throughout the DoD and the IC.

*Oversee the effective integration and interoperability of disparate capabilities developed by separate service providers

Performs personnel management responsibilities with a focus on building a high performance workforce; promote team building and a collaborative work environment; ensure goals and performance objectives are understood; assess performance and provide timely feedback, recognition, and remediation.

Conditions of employment

Must be a current permanent ODNI employee.

Qualifications

Developing and/or applying Information Assurance/ Cybersecurity principles, policies, practices, standards, and controls, to include application of the Risk Management Framework (RMF), relevant to confidentiality, integrity, availability, authentication, and non-repudiation.

Expert knowledge of virtual and cloud computing technologies and concepts, to include DevSecOps; experience with developing system security requirements.

Expert knowledge of network security architecture and systems security engineering concepts, including topology, protocols, components, and principles (e.g., application of defense-in-depth and zero-trust).

*Superior ability to develop or implement information systems security plans and procedures.

Ability to examine available data, applying the facts and own experience, and making decisions that generally prove sound.

Demonstrated ability to balance security compliance with program cost, schedule, performance, or mission needs.

Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.

Demonstrated ability to establish regular contact with high-level internal and external resources and customers, supplying or seeking information on security programs and issues; demonstrated ability to tactfully express ideas or opinions to senior leaders, customers, contractors, and other stakeholders.

Desired Requirements

One year of specialized experience at the next lower GS-grade (or equivalent). Cloud IT related experience may be demonstrated by paid or unpaid experience and/or completion of specific, intensive training (for example, Cloud IT Certification). Cloud IT- related experience demonstrating each of the four competencies (Attention to Detail, Customer Service, Oral Communication, and Problem Solving).

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

We will review your resume and supporting documentation to ensure you meet the basic qualification requirements. If you are among the best qualified, you may be referred to the hiring manager for consideration and may be called for an interview. After reviewing your resume and supporting documentation, a determination will be made. You must submit the supporting documents listed under the required documents section of this announcement.