Clarification from the agency

All U.S. Citizens.

• Monitor network traffic and security alerts for malicious activities and indicators of compromise (IOCs).
• Conduct incident response analysis during possible security breaches, coordinating remediation activities and ensuring effective communication.
• Conduct digital forensic investigations to support incident resolution, compliance, and regulatory requirements.
• Drive continuous improvement in cybersecurity operations through innovation and adoption of new detection technologies.
• Prepare comprehensive reports and briefings for leadership on incident findings, risk assessments, and threat intelligence updates.
• Perform cyber threat intelligence analysis, including threat hunting, and manage Threat Intelligence Platforms (TIPs).

Conditions of employment

• Must be a U.S. citizen
• Must be able to obtain a Top Secret-SCI clearance
• All federal employees who opted into the Deferred Resignation program (DRP) MUST resign prior to appointment in their new position.

Qualifications

GS-11: Applicant must possess at least one (1) year of SE equivalent to the GS-09 grade level. SE is defined as follows:

• Demonstrated experience monitoring and analyzing network traffic, logs, and security alerts for basic indicators of compromise (IOCs) and suspicious activities.
• Demonstrated experience supporting incident response efforts, under supervision, including documenting incidents, performing preliminary triage, and escalating as needed.
• Exposure to cyber threat intelligence processes, including initial research, data enrichment, and contribution to Threat Intelligence Platforms (TIPs).
• Familiarity with common cybersecurity tools (e.g., SIEMs, IDS/IPS) and basic scripting or query skills for analyzing security data.

• Demonstrated experience detecting, analyzing, and responding to security threats, including the ability to independently lead initial incident response activities and recommend remediation strategies.
• Demonstrated experience conducting digital forensic investigations, such as log analysis, data extraction, malware analysis, and ensuring evidence integrity for legal and compliance purposes.
• Experience in cyber threat intelligence operations, including threat hunting, adversary profiling, and integrating intelligence into the organization's defensive posture.
• Strong ability to collaborate with internal and external stakeholders to resolve security incidents, communicate risks, and implement mitigations.
• Experience integrating new tools or technologies into incident detection and response workflows.

• Demonstrated experience leading high-severity cybersecurity investigations, including coordinating cross-departmental efforts and developing comprehensive incident containment, eradication, and recovery strategies.
• Demonstrated the ability to manage complex investigations, handle advanced malware analysis, perform network forensics, and ensure compliance with legal and regulatory frameworks.
• Demonstrated experience managing threat intelligence platforms (TIPs) and leading threat intelligence operations, including collaborating with external intelligence-sharing communities and agencies.
• Demonstrated leadership in mentoring and guiding junior specialists, and leading major IT projects.

• Experience using project management practices to support various IT functions.
• In-depth knowledge of IT and the application of advanced cybersecurity engineering concepts and practices.
• Experience using information technology to identify, forecast, analyze, and research automated systems to discern solutions to problems, approaches, methods, and procedures.
• Demonstrated capacity to lead a team of technical personnel, expertly communicate, and collaborate with subordinates, colleagues, stakeholders, partners, and executives to achieve results.

• CompTIA Security + CE
• Certified Ethical Hacking
• CompTIA Cybersecurity Analyst +

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

Your application will be evaluated and rated under the FBI's Candidate Rating Procedures. Your resume and supporting documentation will be used to determine whether you meet the job qualifications listed in this announcement and will be compared to your responses to the online assessment questionnaire. High self-assessment in the vacancy questions that is not supported by information in your resume, and/or supporting documents may eliminate you from Most Competitive status.

Your application will then be placed in one of three categories: Most Competitive, Competitive, or Least Competitive. Names of candidates in the Most Competitive category will be sent to the hiring official for employment consideration. Veterans' preference will be applied.