Clarification from the agency

This position is being filled under the U.S. Office of Personnel Management (OPM) Direct Hiring Authority (DHA). Under DHA Veterans' preference does not apply. Traditional competitive rating and ranking procedures are not required. Qualified applicants are evaluated based on minimum qualification requirements and job-related competencies. Selections may be made without regard to category ranking procedures.

MAJOR DUTIES

• Lead all Assessment & Authorization (A&A) activities under RMF, ensuring systems meet federal, NIST, and agency cybersecurity requirements.
• Conduct comprehensive security control assessments and manage continuous monitoring activities, including vulnerability scanning, audit log review, and POA&M management to track and remediate risks.
• Provide expert guidance on cybersecurity policies and implementation of security controls.
• Design, implement, and maintain secure architectures across on-prem, cloud, and hybrid environments, including deployment of tools such as firewalls, IDS/IPS, SIEM, and EDR, along with system hardening practices.
• Lead and support cyber incident response efforts, including threat hunting, incident management, forensic analysis, malware investigation, and post-incident reporting with actionable improvements.

Conditions of employment

• U.S. Citizenship is Required.
• You may be required to serve a one-year probationary period.
• Males born after 12/03/59 must be registered for Selective Service.
• Selectee must pass successfully complete a background investigation.
• Selectee must obtain and maintain Secret Clearance.
• You may be required to submit a Financial Disclosure Statement.

Qualifications

You must meet all the requirements below by the closing date of the announcement and they must be clearly identified in your application, resume, or supporting documents. This includes any general and specialized experience, education, and/or selective placement factors mentioned. These are used to determine if you possess the knowledge, skills, and/or abilities to successfully perform in this position.

Specialized Experience
To qualify at the GS-14 level, you must have at least one year of specialized experience obtained in the private or public sector that is equivalent to the GS-13 level. Specialized experience is defined as

1.) Serving as an Information System Security Officer (ISSO) responsible for maintaining enterprise system security posture and supporting continuous Authorization to Operate (ATO) under the NIST Risk Management Framework (RMF), independently implementing and managing risk-based security controls and continuous monitoring activities to ensure ongoing compliance with federal cybersecurity requirements.

2.) Leading the development, coordination, and maintenance of comprehensive security authorization documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms), providing authoritative technical input to support authorization decisions and audit readiness.

3.) Conducting enterprise-level risk assessments and vulnerability management activities, applying advanced cybersecurity expertise to identify, analyze, and mitigate system weaknesses while ensuring compliance with federal information security standards and organizational policies.

4.) Performing senior-level systems engineering and administration functions in support of secure system design, configuration, and maintenance, independently managing system security requirements across mission-critical environments and ensuring alignment with defense-in-depth principles and secure architecture standards.

AND

5.) Providing enterprise monitoring and incident response support, leveraging advanced technical knowledge to detect, analyze, and respond to security events while supporting continuity of operations and strengthening overall cybersecurity resilience.

Experience refers to paid and unpaid experience, including volunteer work done through national service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills, and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.

How you will be evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

BASIS OF RATING:

If you meet the minimum qualifications for this position, your resume will be evaluated by a Subject Matter Expert Panel (SME). Your resume serves as the basis for qualification determinations and must highlight your most relevant and significant work experience(s) as it relates to this job opportunity.

If after reviewing your resume and/or supporting documentation, a determination is made that you have inflated your qualifications and/or experience, you may be excluded from further consideration for this position. Please follow all instructions carefully. Errors or omissions may affect your rating.

You will be further evaluated on the following Competencies required for the position:

• Risk Management Framework (RMF) & ATO Lifecycle Management
• Security Authorization Documentation & Compliance Reporting
• Enterprise Risk Assessment & Vulnerability Management
• Secure Systems Engineering & Architecture
• Incident Response & Continuous Monitoring Operations

We DO NOT require a separate narrative statement responding to the competencies; however, your resume must CLEARLY show possession of these competencies.

If you meet the qualifications stated above and you are among the top candidates your application may be referred to the Selecting Official for further review.

Your experience is also evaluated using an assessment questionnaire, which is available at the following link: https://apply.usastaffing.gov/ViewQuestionnaire/12946521

To receive consideration, you must complete the questionnaire and submit the documentation specified below by 05/12/2026

• The Content of Resume: Your resume, curriculum vitae, or other written form you choose to describe your job-related experiences are used to verify your qualifications. Therefore, it is important that your resume accurately reflects the duties and responsibilities under each position you have held with each employer. In describing your experience, please be clear and specific. It is your responsibility to make sure your resume states complete information for each job entry (beginning and ending dates of employment stated as MM/YYYY; and total number of hours worked per week). If your resume does not provide enough information regarding your work history for us to make a creditable qualification determination, your application package may be rendered disqualified, and you will no longer be considered for this position.
• Career Transition Assistance Program (CTAP) or Interagency Career Transition Assistance Program (ICTAP) eligibles must submit the following documents: a copy of their agency notice, a copy of their most recent performance rating, and a copy of their most recent SF-50, Notification of Personnel Action, indicating their current position, grade level, and duty location. Please note that applicants will not qualify if the vacancy being applied for has a higher promotion potential than the last position they held.
• Cover Letter:This is optional.

Next steps