Serves as the Cybersecurity Lead for the U.S. Tax Court, acting as the technical authority for cybersecurity engineering, threat detection, and information security operations across on-premises and cloud environments.

Leads the design, implementation, and continuous improvement of security monitoring and detection capabilities. Develops, maintains, and executes log analysis and correlation strategies using Security Information and Event Management (SIEM) tools, including the creation, tuning, and automation of Splunk searches, alerts, dashboards, and scripted queries to identify indicators of compromise, anomalous behavior, and policy violations.

Leads phishing detection and response activities. Designs and manages technical and procedural controls to prevent, detect, analyze, and respond to phishing and socially engineered attacks. Performs forensic analysis of suspicious emails, headers, URLs, and attachments; coordinates containment and remediation actions; and collaborates with IT and business stakeholders to reduce phishing risk through controls, monitoring, and user awareness.

Directs malware detection, containment, and remediation efforts. Oversees endpoint, server, and cloud-based protection technologies; analyzes alerts and telemetry related to malicious code, ransomware, and unauthorized software; investigates root cause; and leads coordinated response actions to eradicate threats and restore systems securely.

Performs continuous security monitoring in accordance with the National Institute of Science and Technology (NIST) Risk Management Framework (RMF) requirements. Analyzes vulnerability scan results, system logs, and security control metrics to assess risk posture and identify trends. Develops metrics and reports to communicate security status, risks, and recommended corrective actions to leadership.

Conducts security investigations and incident responses for confirmed or suspected cybersecurity events. Leads technical analysis, determines scope and impact, preserves evidence, documents findings, and recommends remediation and preventive measures. Coordinates incident response activities with internal teams and, as necessary, external partners and vendors.

Provides security engineering expertise throughout the system life cycle. Reviews system architectures, cloud configurations, application designs, and proposed changes to ensure security controls are integrated, and risks are addressed prior to deployment. Assesses the security impact of system changes through change and configuration management processes.

Develops, reviews, and maintains cybersecurity documentation, including System Security Plans (SSPs), risk assessments, incident response documentation, and continuous monitoring artifacts. Ensures documentation accurately reflects system configurations and implemented security controls.

Implements and enforces identity and access management, network security, endpoint security, and data protection controls. Ensures least-privilege access, secure authentication, and protection of sensitive Court information.

Provides advanced Tier 2/3 technical support for cybersecurity-related incidents and problems. Analyzes complex issues, determines root causes, and implements corrective actions in coordination with IT operations teams.

Develops cybersecurity policies, standards, and procedures. Provides technical guidance and training to IT staff and users on phishing awareness, malware prevention, security monitoring, and incident response responsibilities.

Supports IT governance, acquisition, and vendor oversight by defining cybersecurity requirements, evaluating proposed solutions, and ensuring security considerations are integrated into Court IT initiatives.

Supports Information Program Specialist with sourcing, procurement, and vendor management activities, as necessary.
Writes, reviews, and/or maintains technical documentation for assigned technology or product environments (i.e., cybersecurity).

Conditions of employment

• Applicants must be United States Citizens or Nationals.
• All Court employees are required to adhere to the Code of Conduct for U.S. Tax Court Employees.
• Employees of the U.S. Tax Court are considered "at-will" employees, and, as such, may be terminated with or without cause.
• Those who are required must abide by Selective Service registration requirements.
• Selection of this position is contingent upon favorable suitability determination and security background checks, including a credit check, a Federal income tax check and a criminal check. A candidate selected for this position must be current on his or her federal income tax obligations before employment with the U.S. Tax Court and must remain current at all times while employed by the U.S. Tax Court. Continued employment post appointment is subject to satisfactory completion of the background investigation and credit check and favorable adjudication. A background reinvestigation or supplemental investigation may be required at a later time during employment.
• All applicant information is subject to verification.
• The Federal Financial Reform Act requires direct deposit of federal wages for Court employees.

Qualifications

Minimum Required
GS-13

• Bachelor's or Master's degree in computer science, cybersecurity or related field
• 8+ years of experience in cybersecurity, especially in a security engineering roles related to networks, mobile devices, or application development
• 6+ years of experience working with AWS, Microsoft 365, Azure, or other comparable cloud platforms
• 4+ years experience performing Configuration as Code (CaC) and Infrastructure as Code (IaC) using modern software and source code practices (e.g., DevOps, CI/CD) with languages such as Terraform, .NET, Go, Java, Javascript, Objective-C, PHP, Powershell, Ruby, Cisco IOS
• Maintain a CompTIA Security+ certification as well as two certifications from the preferred certification list or other identified by supervisor/hiring manager

GS-14

• Meet requirements for GS-13
• 12+ years of experience in cybersecurity, especially in a security engineering roles related to networks, mobile devices, or application development

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

How You Will Be Evaluated: If you meet the minimum qualifications for this position, the Court will then evaluate your application package to assess the quality, depth, and complexity of your accomplishments, experience, and education as they relate to the requirements listed in this vacancy announcement.

HOW TO APPLY: Applicants may apply by submitting the following:

1. A letter of interest/cover letter;
2. A resume highlighting relevant knowledge and experience;
3. Transcripts showing your bachelor's degree and any advanced degrees from an accredited college or university;
4. If you have federal government experience, your most recent Notification of Personnel Action, SF-50; and
5. A supplemental written statement, not to exceed two pages, which provides a brief description of how your experience relates to the duties outlined in this vacancy announcement.

These application materials are due by 11:59 PM (ET) on the closing date of this vacancy announcement.

NOTE: AN INCOMPLETE APPLICATION WILL NOT BE CONSIDERED.

The United States Tax Court is an equal opportunity employer.

Next steps