Duties

Summary

This position is located within the IT Security Office (ITSO). The incumbent is a recognized cyber security expert with a proven record of successfully managing defensive cyber operations in a 24/7 environment. Must have a proven record of successfully leading cyber detection, response and recovery activities at a national level, and "hands on" experience with intrusion detection and incident response. Will perform multiple and varying assignments under Security Operations Division Chief.
Learn more about this agency

Responsibilities

The incumbent is responsible for overseeing and participating in the management of Security Operations Center (SOC) intrusion detection shift. This work is performed by a skilled contractor cyber team, whose focus is on security event monitoring, alerting, and response as part of a shift that forms part of the Judiciary's 24/7 coverage team. The incumbent will facilitate the successful discovery of intrusion attempts and compromises through reviews and analysis of relevant event detail and summary information and must be able to synthesize data from multiple logging sources. The intrusion detection shift lead is the subject matter expert for all intrusion detection and reporting activities with oversight for their assigned shift. The incumbent provides authoritative decisions for handling incidents reported to the government. The incumbent may be asked to support the government mentoring training of Court personnel who visit the SOC to experience the work being performed. The intrusion detection shift lead acts as a point of contact for escalations to ITSO-SOC management or the Judiciary Automated Systems Incident Response Capability. The major duties include, but are not limited to:

Directing a contractor shift team of individuals responsible for providing Cyber monitoring, detection and reporting.

Overseeing and coordinating the activities of shift team supporting the security of critical production environments.

Executing Cyber emergency response procedures.

Working closely with Court Incident Response Teams to analyze and resolve security incidents.

Developing and maintaining technical, analytical, and practical proficiencies needed to ensure the team is successful in the discovery of intrusion attempts and compromises.

Developing, maintaining, and reporting upon metrics to measure operational effectiveness; providing reports and statistics as required to ITSO management, as requested.

Leading the shift team according to strategies and plans for projects/platforms, ensuring overall alignment to the IT security strategy.

Coordinates with other government agencies and law enforcement organizations to facilitate information sharing and joint response actions for any cross-agency or criminal incidents.

Travel Required

Occasional travel - You may be expected to travel for this position.

Supervisory status
No

Promotion Potential
00

Requirements

Conditions of Employment

All information is subject to verification. Applicants are advised that false answers or omissions of information on application materials or inability to meet the following conditions may be grounds for non-selection, withdrawal of an offer of employment, or dismissal after being employed.

Selection for this position is contingent upon completion of OF-306, Declaration of Federal Employment during the pre-employment process and proof of U.S. citizenship for competitive status positions or conversion to a competitive status position with the Administrative Office of the US Courts. In instances where non-citizens are considered for hire into temporary or any other position with non competitive status or when it is confirmed by the AO's Human Resources Office that there are no qualified U.S. citizens for a competitive status position (unless prohibited by a law or statue), non-citizens must provide proof of authorization to work in the United States and proof of entitlement to receive compensation. Additional information on the employment of non-citizens can be found at http://www.usajobs.gov/Help/working-in-government/non-citizens. For a list of documents that may be used to provide proof of citizenship or authorization to work in the United States, please refer to Form I-9, Employment Eligibility Verification.

All new AO employees will be required to complete a FBI fingerprint-based national criminal database and records check and pass a public trust suitability check.

You will be required to serve a trial period if selected for a first-time appointment to the Federal government, transferring from another Federal agency, or serving as a first-time supervisor. Failure to successfully complete the trial period may result in termination of employment. This does not apply to current federal Judiciary employees.

Relocation expenses may be provided, but only if authorized by the Director of the AO.

More than one selection may be made from this announcement.

All requirements must be met by the closing date of this announcement.

Qualifications

Applicants must have demonstrated experience as listed below. This requirement is according to the AO Classification, Compensation, and Recruitment Systems which include interpretive guidance and reference to the OPM Operating Manual for Qualification Standards for General Schedule Positions.

Basic Requirements: You must have Information Technology (IT) related experience which demonstrates proficiency in each of the following competencies:

Attention to Detail - Is thorough when performing work and conscientious about attending to detail.

Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services.

Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately.

Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations.

AND

Specialized Experience : Applicants must have at least one full year (52 weeks) of specialized experience which is in or directly related to the line of work of this position. Specialized experience is demonstrated experience in in BOTH of the areas defined below:

Working in a cyber security operations environment managing end-to end intrusion detection process; AND

Leading and managing workloads of a security operations center personnel.

(Resume must show clear and convincing evidence of all areas of specialized experience. We will not make assumptions.)

Applicant must have an active TS/SCI or must be able to receive one.

Education

This position does not require education to qualify.

Additional information

The AO is an Equal Opportunity Employer.

How You Will Be Evaluated

You will be evaluated for this job based on how well you meet the qualifications above.

We will review your resume and supporting documentation and compare this information to your responses on the occupational questionnaire to determine if you meet the minimum qualifications for this job. If you meet the minimum qualifications for this job, we will evaluate your application package, to assess the quality, depth, and complexity of your accomplishments, experience, and education as they relate to the requirements listed in this vacancy announcement.

You should be aware that your ratings are subject to evaluation and verification. If a determination is made that you have rated yourself higher than is supported by your resume and/or narrative responses, you will be assigned a rating commensurate to your described experience. Failure to submit the mandatory narrative responses will result in not receiving full consideration and/or rating credit. Deliberate attempts to falsify information may be grounds for not selecting you, withdrawing an offer of employment, or dismissal after being employed.

Background checks and security clearance

Security clearance
Not Required

Drug test required
No

Required Documents

For this job announcement the following documents and/or information are required:

• Resume - Any written format you choose to describe your job-related qualifications.
• Citizenship - Include country of citizenship on resume.
• Notification of Personnel Action (SF-50) - All applicants outside of the AO must submit a copy of your latest SF-50 to verify current or former Federal employment status.
• Veterans Preference documentation - Certificate of Release or Discharge from Active Duty (DD Form 214), if applicable Application for 10-Point Veteran Preference (SF-15) and an official statement, dated 1991 or later, from the Department of Veterans Affairs or from a branch of the Armed Forces, certifying to the veteran's present receipt of compensation.

If you are relying on your education to meet qualification requirements:

Education must be accredited by an accrediting institution recognized by the U.S. Department of Education in order for it to be credited towards qualifications. Therefore, provide only the attendance and/or degrees from schools accredited by accrediting institutions recognized by the U.S. Department of Education .

Failure to provide all of the required information as stated in this vacancy announcement may result in an ineligible rating or may affect the overall rating.