Clarification from the agency

This detail opportunity is for current competitive and excepted service employees only. If you are not a current federal civilian employee you will not be eligible for this position. DHS Joint Duty Assignments do not apply to members of the Military service or contractors.

The joint duty assignment will serve a role as an analyst on CISA's Cybersecurity Division (CSD)- Joint Cyber Defense Collaborative (JCDC) - Chief of Ops Office(COP) Analytical and Triage team. The analyst will participate on a team responsible for the initial triage and analysis of International, Federal, Industry, State Local Tribal Territorial partner shares of cyber information. Analysts will act as SMEs during technical exchanges with partners, for scoring of CSD and JCDC operational priorities based on available information, and for sharing back information that has been enriched from CISAs holdings.

Conditions of employment

• Must be a current permanent Federal employee
• Must have supervisory approval to apply to the Joint Duty Assignment. DHS 250-2 Application Form under "required documents" section.
• Must NOT have any pending/outstanding disciplinary actions
• Must have achieved a minimum of "meet expectations/proficiency" on latest performance appraisal/evaluation
• Must be currently at the grade level of the detail. *No Temporary Promotion Opportunity*
• The program does not apply to members of the Military service or contractors.

Qualifications

Qualifications required:

1. Access to a SCIF
2. Combined 7+ years' experience in any number of cybersecurity fields (preferably network, host, and intelligence analysis)
3. Strong network-based analysis and analytic discovery skills (e.g., knowledgeable about common network/security protocols [HTTP, SSL, SSH, DNS/secure DNS, etc.], including ability to identify normal vs. abnormal behavior)
4. Familiarity with host-based anomaly detection (e.g., have basic understanding of what normal process trees look like, vs. malware injection into a process, etc.)
5. Experience connecting open-source information with network and/or host-based anomalies (e.g., identifying cyber threat intelligence about suspicious processes, finding new insights through tools such as VirusTotal, understanding of how to find threat intelligence about malformed HTTP traffic, etc.)
6. Hands-on experience with open-source cyber threat/related tools (e.g., VirusTotal, Maltego, Shodan, exploit-db, etc.)
7. Familiarity working with public/purchased Cyber Threat Intel (CTI) feeds/data (e.g., Crowdstrike reporting, GreyNoise, RecordedFuture, Palo Alto Xpanse, or others)
8. Excellent time-management skills with the ability to work in a collaborative team on a common project/event, as well as on your own.
9. Excellent mission documentation skills; familiarity with ServiceNow, Confluence, and JIRA is a plus.
10. Comfort to autonomously engage with others across the Agency/organization to obtain relevant information in support of unique mission needs.
11. Familiarity with Red Teaming / Cyber exploitation concepts (e.g., killchain, MITRE ATT&CK, common hacker tools such as Metasploit/Meterpreter, Kali linux, etc.)
12. Ability to code/script simple programs and functions in Python, bash, powershell, etc., to enable analytic triage and automation.
13. Familiarity with Amazon AWS/S3, Jupyter Notebooks, and experience using specific CTI APIs is a plus; fusing multiple mission-relevant data streams is a highly desired.
14. Broad familiarity with the tactics, techniques, procedures (TTPs) of nation-state and/or ransomware actors is desired; specialization in key nation-state intel a plus.
15. Excellent technical reasoning skills / considers analysis of competing hypothesis (ACH) / values quality over quantity / proactive & self-starting approach to work.
    

1. Job Title (Include series and grade of Federal Job)
2. Duties (Be specific in describing your duties)
3. Name of Federal agency
4. Supervisor name, email, and phone number
5. Start and end dates including month and year (e.g. June 2007 to April 2008)

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

We will review your resume and supporting documentation to ensure you meet the basic qualification requirements. If you meet the minimum qualifications, your experience, education, and training will be rated using a job questionnaire based on the competencies or knowledge, skills, and abilities needed to perform this Joint Duty Assignment.

If you are among the best qualified, you may be referred to the hiring manager for consideration and may be called for an interview. After reviewing your resume and supporting documentation, a determination will be made. You must submit the supporting documents listed under the required documents section of this announcement.

Note: DHS continues to take necessary steps to keep our workforce safe amid the COVID-19 pandemic. If you receive a final Joint Duty Assignment offer to onboard, please complete the onboarding requirements and/or forms and submit them electronically in an expeditious manner. Your start date may be delayed if the action above is not completed.