Clarification from the agency

United States Citizens. If you are a current or former federal or eligible under a special hiring authority (VEOA, Schedule A, etc.), you may be eligible to apply under the concurrently advertised merit promotion vacancy announcement: OSERS-2024-0013.

APPLICATION LIMIT: This vacancy announcement is limited to the first 75 applications received and will close at 11:59PM Eastern Time on the day that we receive the 75th application, or at 11:59PM Eastern Time on the listed closing date, whichever occurs first. 

We encourage you to read this entire vacancy announcement prior to submitting your application.

As an Information Technology Specialist, GS-2210-13, you will be responsible for:

• Responsible for overseeing information security, cybersecurity and IT risk management programs based on industry-accepted information security and risk management frameworks.  Risk management framework includes identifying threats, assessing vulnerabilities, determining risks, implementing control strategies and continuous monitoring.

• Develop and manages the frameworks, processes, tools and consultancy necessary for IT to properly manage risk and to make risk-based decisions related to IT activities.

• Conduct cyber security response actions associated with protecting, monitoring, analyzing, detecting, and responding to cyber events, breaches, and incidents.

• Identify and mitigates IT risks as well as respond to observations identified by third party auditors or examiners while assisting in the development of periodic reports and dashboards presenting the level of controls compliance and current IT risk posture.

• Ensure overall IT compliance with regulatory requirements through proactive planning and communication, ownership and relationships.

• Coordinate the continuous development, implementation and updating of security and privacy policies, standards, guidelines, baselines, processes and procedures in compliance with NIST standards.

• Responsible for assisting IT managers and staff with the audits and facilitate management response and remediation efforts.
• Coordinate the continuous development, implementation and updating of security and privacy policies, standards, guidelines, baselines, processes and procedures in compliance with NIST standards.

Conditions of employment

• Relocation will not be paid.
• Males 18 and over must be registered with the Selective Service.
• You may be subject to serve a one-year probationary period.
• Must be a US Citizen.
• Background Investigation is required.

You must meet all qualification requirements within 30 days of the closing date of this vacancy announcement.

Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills, and can provide valuable training and experience that translates directly to paid employment. We will consider all qualifying experience, including any volunteer experience.

Conditions of Employment

TELEWORK ELIGIBLE ONLY POSITIONS:

TELEWORK ELIGIBILITY:

• You may be eligible for occasional telework in which you are required to report to the office on a regular basis. Participation must be requested and approved by the supervisor and there must be a signed telework agreement. The number of telework days approved is determined by the agency policy, emergency situations, the approval of your immediate supervisor. You must have access to high speed internet and cell phone service meeting current Agency policy from the approved work location.  

Qualifications

Minimum Qualification Requirements
You may meet the minimum qualifications for the GS-13, if you possess the specialized experience.

Specialized Experience for the GS-13
One year of experience in either federal or non-federal service that is equivalent to at least a GS-12 performing two (2) out of three (3) of the following duties or work assignments:

1. Experience identifying acceptable levels of residual risk and assist with action plans, policy and procedural changes for risk mitigation.
2. Experience providing strategic recommendations to key IT projects to help improve project results, quality of deliverables, risk optimization, security processes and compliance with regulations.
3. Experience developing, implementing and updating information security regulatory requirements, standards, and practices such as NIST 800-53.

Experience must be IT related; the experience may be demonstrated by paid or unpaid experience and/or completion of specific, intensive training (for example, IT certification), as appropriate.  For all positions individuals must have IT-related experience demonstrating each of the four competencies listed below. 

1. Attention to Detail - Is thorough when performing work and conscientious about attending to detail.
2. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services.
3. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately.
4. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations.

Knowledge, Skills, and Abilities (KSAs)
The quality of your experience will be measured by the extent to which you possess the following knowledge, skills and abilities (KSAs). You do not need to provide separate narrative responses to these KSAs, as they will be measured by your responses to the occupational questionnaire (you may preview the occupational questionnaire by clicking the link at the end of the Evaluations section of this vacancy announcement).

1. Knowledge of governmental agency information security, governance, risk and compliance practices and standards.

2. Knowledge of information security regulatory requirements and standards such as NIST 800-53.

3. Knowledge of IT processes and controls and strong understanding of risk and control frameworks.

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

We use a multi-step process to review and evaluate applicants:

1. Eligibility and Minimum Qualifications

Once the vacancy announcement closes, we will review your submitted resume and documents to determine if you meet the eligibility and minimum qualification requirements, including any required education, experience, and/or selective placement factors. You will be rated as ineligible if you are outside of the area of consideration (i.e., who may apply) or your application is missing any required documents. You will be rated as not qualified if you do not possess the minimum qualification requirements.

2. Rating and Ranking

If you are found to meet both the eligibility and minimum qualification requirements, we will assess the quality of your experience and the extent to which you possess the required KSAs by comparing your submitted resume and documents against your responses to the occupational questionnaire. Your application may be referred to a subject matter expert or panel of subject matter experts for further evaluation. Based on the outcome of this evaluation, you will be placed into one of three categories: Best Qualified, Well Qualified, or Qualified. If your responses to the occupational questionnaire are not substantiated by your submitted resume, you may be eliminated from receiving further consideration. Veterans’ Preference: Qualified veterans’ preference eligibles will be ranked ahead of qualified non-preference eligibles within each category for which they are qualified. Qualified veterans’ preference eligibles with a compensable service-connected disability of 10 percent or more (CPS and CP) will be placed at the top of the Best Qualified category, except in the case of scientific or professional positions at the GS-9 grade level or higher.

Based on the outcome of this evaluation candidates will be assigned a numerical score out of a possible 100 and be placed into one of three categories: Best Qualified, Well Qualified, or Qualified.  The three categories are defined below:

Best-Qualified Category – Applicants who have a score between 95 and 100.  Demonstrates better overall or key knowledge, skills, or abilities for a specific position.

Well-Qualified Category – Applicants who have a score between 85 and 94.99.  Possesses the knowledge, skills, and abilities which clearly exceed the minimum qualification requirements for the position but does not necessarily meet the definition of best qualified.

Qualified Category – Applicants who have a score between 70 and 84.99. Meets the minimum qualification standards for a specific position.

3. Referral and Selection

If you are found to be amongst the most highly qualified applicants, you will be referred to the selecting official. As part of the assessment and selection process, the selecting official may invite you to participate in a structured interview, check your references, and/or request that you submit a writing sample or complete a written assessment or exercise to further evaluate your qualifications for this position. If you require reasonable accommodation for any part of the interview process or written assessment or exercise, please inform the selecting official at the time of scheduling.