IT Cybersecurity Specialist

Clarification from the agency

United States Citizens and Nationals. This position may be filled through the Direct Hire Authority. All applicants who meet the qualification requirements will be forwarded to the selecting official for further consideration. Category Rating, Veterans Preference, Schedule A and traditional rating and ranking of applicants does not apply to this vacancy. DIRECT HIRE AUTHORITY: This position is being filled using Direct-Hire Authority (5 CFR 337.201) for this occupation

The Gallery’s Digital Solutions division (TDS) reports to the Gallery’s Treasurer and provides IT solutions, services and innovation. This Information System Security Officer (ISSO) position reports to the Chief Information Security Officer (CISO) and maintains a secure operating environment for business applications including the continuous monitoring of information technology assets, services and processes to which they are assigned.

Duties for this position include

• Maintain the Gallery catalog of IT enterprise and departmental systems with information including but not limited to: (i) system points of contact, (ii) vendor point of contact, (iii) Tier, (iv) location, (v) type (i.e., Cloud, on-premise, hybrid, colocation, etc.). Review vendor capabilities and security posture for potentially new IT systems/applications/services and provide recommendation on risk to the Gallery. Collaborate with the CISO, CIO, system managers, and other stakeholders to finalize IT security requirements for third-party IT systems/applications/services.
• Ensure vendors/contractors/providers comply with the Gallery IT security policies and procedures established as part of the third-party risk management program. Work with the Gallery’s Contracts and Procurement Office (APC) to ensure all applicable IT security requirement.
• Review results of vulnerability scans (internal or third-party) for third-party applications/systems/devices and work with the appropriate system managers and operations (TDS-OPS) personnel to remediate critical and high vulnerabilities. Support the triage of potential security incidents related to third-party breaches, following the established IT security incident response process, and supporting remediation efforts.                                                                                                                                                                                                              

Conditions of employment

• You must be a United States Citizen.
• This employer participates in the e-Verify program.
• Males born after 12/31/59 must be registered for Selective Service
• Pass Pre-employment Background Investigation
• Suitable for Federal employment, determined by a background investigation
• May be required to successfully complete a probationary period

Qualification requirements must be met by the closing date of the announcement. For information on qualification requirements, see Qualification Standards Handbook for General Schedule Positions viewable on OPM Website. It is your responsibility to ensure that you submit appropriate documentation prior to the closing date. Your resume serves as the basis for qualification determinations and must highlight your most relevant and significant experience as it relates to this job announcement. Be clear and specific when describing your work history since human resources cannot make assumptions regarding your experience.

Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Your resume must include the dates of all qualifying experience (from month/year to month/year) and the number of hours worked/volunteered per week.

Qualifications

1. Attention to Detail - Is thorough when performing work and conscientious about attending to detail.
2. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services.
3. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately.
4. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to gen

Specialized Experience Statement: To qualify for the GS-13 level, you need to have at least one year of full-time experience equivalent to the GS-12 level defined as: experience assessing and managing third-party cybersecurity risks associated with vendor-managed services, cloud service providers, software-as-a-service (SaaS) platforms, and other externally hosted systems and applications; conducting security reviews to identify and mitigate vulnerabilities; implementing vulnerability management processes; and recommending safeguards to protect information systems, networks, and organizational data

OPM Qualifications Standard:

You must meet all qualification and eligibility requirements by the closing date of this announcement.

Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

Your resume will be used to evaluate your experience, education, and/or training that address the competencies below: 

Attention to Detail, Customer Service, Decision Making, Information Management, Interpersonnal Skills, Oral Communication, Problem Solving, Team Work, Technical Competence. 

• Information Systems/Network Security - Knowledge of methods, tools, and procedures,  including development of information security plans, to prevent information systems  vulnerabilities, and provide or restore security of information systems and network services. 
• Information Assurance - Knowledge of methods and procedures to protect information systems and data by ensuring their availability, authentication, confidentiality, and integrity.
• Technology Awareness - Knowledge of developments and new applications of information  technology (hardware, software, telecommunications), emerging technologies and their  applications to business processes, and applications and implementation of information systems  to meet organizational requirements. 

This announcement is issued under the "direct-hire" authority. Consistent with 5 U.S.C. 3304(a)(3) and OPM regulations (5 CFR 337 Subpart B) on direct-hire: All candidates who meet all the qualifications and other eligibility requirements may be referred for consideration. Competitive examining rules providing for rating and ranking and veterans' preference do not apply.

Overstating your qualifications and/or experience in your application materials or application questionnaire may result in your removal from consideration. Cheating on an assessment may also result in your removal from consideration.

Note: Applicants who are referred to the hiring office for selection consideration may be required to submit writing and/or work samples as part of the interview/selection process. If the hiring office decides to request a writing and/or work sample as part of its selection process, the vacancy contact will reach out to you by email to: (1) inform you of this requirement; and (2) provide further instructions.

• Your resume should include relevant work experience, applicable education and your contact information. For current or previous federal employees, include the pay plan, series and grade.

To apply for this position, you must provide a complete Application Package which includes:

1. Your Resume (no more than 2 pages) showing the applicant's name, email address, work schedule, hours worked per week, dates of employment, and duties performed to include pay plan, series, and grade level for relevant federal experience. Your resume must show complete information for each job entry to support minimum qualifications.

• Do not include the following types of information in your resume:
  • Classified or government sensitive information
  • Social Security Number (SSN)
  • Photos of yourself
  • Personal information, such as age, gender, religious affiliation, etc.
  • Encrypted and digitally signed documents

2. Other supporting documents:
   • Cover Letter, optional
   • Most recent Performance Appraisal, optional
   • Veterans' Preference documentation, if applicable (e.g. DD-214 Member Copy 4 showing type of discharge/character of service; Current Active Duty members must submit a certification of expected discharge or release from active duty under honorable conditions dated within 120 days; SF-15 Form and related documentation; VA letter.) If you are a veteran and you are claiming 5-point veterans' preference, you must submit a copy of your DD-214 or other proof of eligibility.
     If you are a veteran and you are claiming 10-point veterans' preference, you must also submit an SF-15, "Application for 10-Point Veterans' Preference" plus the proof required by that form. For more information on veterans' preference click here.

Failure to submit any of the above-mentioned required documents may result in loss of consideration due to an incomplete application package. 

Next steps