Information Technology Specialist (Security Operations Center), GS-2210-15 (Direct Hire) (Information Technology Specialist (Team Lead))
What you'd do
This position is located in the U.S. Department of Education (ED) Office of Federal Student Aid (FSA). FSA is a Principal Office of the United States Department of Education responsible for awarding billions of dollars in federal student aid funds. Our vision is to be the most trusted and reliable source of student financial aid, information, and services in the nation.
Major duties
APPLICATION LIMIT: This vacancy announcement is limited to the first 200 applications received and will close at 11:59PM Eastern Time on the day that we receive the 200th application, or at 11:59PM Eastern Time on the listed closing date, whichever occurs first. We encourage you to read this entire vacancy announcement prior to submitting your application. As an Information Technology Specialist (Security Operations Center): GS-2210-15, you will be responsible for: • Leading FSA's cyber defense operations, overseeing real-time monitoring, incident command, escalation, and coordination with federal partners such as CISA, and US‐CERT. • Ensuring compliance with FISMA and NIST RMF, maintains documentation and audit readiness, and drives the development of response playbooks. The manager also guides modernization of SIEM/SOAR capabilities, integrates threat intelligence, leads threat‐hunting efforts, and builds a cleared cyber workforce aligned with the NICE Framework. • Ensuring compliance with FISMA and NIST RMF, maintaining documentation and audit readiness, and driving the development of response playbooks. • Guiding modernization of SIEM/SOAR capabilities, integrates threat intelligence, leading threat‐hunting efforts, and building a cleared cyber workforce aligned with the NICE Framework. Additionally, the position provides executive-level briefings and ensures timely, accurate reporting for mandated and congressional cybersecurity inquiries. •Overseeing IT systems throughout their full engineering lifecycle, ensuring secure design, development, implementation, maintenance, and retirement.
What you need to qualify
Minimum Qualification Requirements You may meet the minimum qualifications for the GS-15, if you possess the specialize experience. Specialized Experience for the GS-15 One year of experience in either federal or non-federal service that is equivalent to at least a GS-14 performing two (2) out of three (3) of the following duties or work assignments: 1. Experience serving as a professional with specialized knowledge coordinating Pen Testing, Red Team, and Purple Team exercises, testing defenses against simulated attacks, applying threat intelligence, updating playbooks to continuously develop the SOC analytics capabilities, determining strategic requirements and providing technical direction and analysis. 2. Experience in leading team members in advanced cyber incident triage and response efforts, including detection, investigation, containment, eradication, and recovery, for complex security events such as APTs and data exfiltration attempts, while documenting findings, ensuring alignment with IR plans and NIST SP 800-61r2, improving SOC workflows, SOPs, and playbooks ensuring information systems reliability and accessibility; and defending against unauthorized access to systems. 3. Experience providing support for Security Event and Incident Management (SIEM), Endpoint Detection and Response (EDR), and Continuous Diagnostics and Mitigation (CDM) systems for security functionality for existing and new business systems. Basic Experience Requirements: Applicants may qualify by meeting or exceeding the minimum proficiency level established for each of the required competencies, in addition to meeting the specialized experience requirement as demonstrated through the assessment of skills. You must possess IT-related experience (paid or unpaid experience and/or completion of specific, intensive training (e.g., IT certification), as appropriate) demonstrating each of the nine competencies listed below. Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Customer Service - Works with clients and customers (i.e., any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Decision Making - Makes sound, well-informed, and objective decisions; perceives the impact and implications of decisions; commits to action, even in uncertain situations, to accomplish organizational goals; causes change. Information Management - Identifies a need for and knows where or how to gather information; organizes and maintains information or information management systems. Interpersonal Skills- Shows understanding, friendliness, courtesy, tact, empathy, concern, and politeness to others; develops and maintains effective relationships with others; may include effectively dealing with individuals who are difficult, hostile, or distressed; relates well to people from varied backgrounds and different situations. Oral Communication- Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving- Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. Teamwork- Encourages and facilitates cooperation, pride, trust, and group identity; fosters commitment and team spirit; works with others to achieve goals. Technical Competence- Uses knowledge that is acquired through formal training or on-the-job experience to perform one's job; works with, understands, and evaluates technical information related to the job; advises others on technical issues. Knowledge, Skills, and Abilities (KSAs) The quality of your experience will be measured by the extent to which you possess the following knowledge, skills and abilities (KSAs). You do not need to provide separate narrative responses to these KSAs, as they will be measured by your responses to the occupational questionnaire (you may preview the occupational questionnaire by clicking the link at the end of the Evaluations section of this vacancy announcement). 1. Knowledge of the latest IT management concepts, theories, principles, standards, methods, practices, and techniques sufficient to oversee and direct the assurance of reliability, accessibility, security for the IAM systems, SIEM, EDRs, and ServiceNOW ticket system, and to advise other IT professionals, project managers, and management officials. 2. Ability to summarize, interact and communicate complex issues, relevant analyses, and programmatic options to senior leadership, key managers, technical professionals at all levels throughout the organization. 3. Ability to plan and integrate information assurance and security related projects and concepts requiring introduction of innovative technology, in a complex organizational context. 4. Knowledge of commercial and Infrastructure Management concepts and technology, to provide technical input units on integration, of information assurance capabilities, to better support our missions. 5. Ability to use written and verbal communications of a complex and high-level nature, formal public speaking and presentation, negotiation, and persuasion of individuals with competing or conflicting interests and potentially hostile motivation sensitivity to many divergent viewpoints, multi-cultural and political awareness, and appreciation.
Before you apply
Federal applications are different: your resume should be 3–5 pages and mirror the language of this announcement. Read our federal resume guide first — it's the #1 reason qualified people get screened out.
Don't miss the next one.
Get an email the moment a similar federal job opens — postings can close in as little as 5 days.