Cybersecurity Investigations Analyst

Summary The mission of TIGTA's Office of Investigations is to protect the Internal Revenue Service (IRS) from internal and external threats and corruption that could negatively impact the IRS' administration of tax laws. We detect and deter waste, fraud and abuse in IRS programs and operations and protect the IRS against internal misconduct, corruption and external attempts to corrupt or threaten employees. We provide independent oversight to Treasury on IRS activities & IRS Office of Chief Counsel. Responsibilities This position is located at the Treasury Inspector General for Tax Administration, Office of Investigation (OI) - Region 3, Cybercrimes Investigations Division, Cyber Analysis Branch. As a Cybersecurity Investigations Analyst, you will: Serve as a cybersecurity information technology specialist investigating unusual problems, questions, or conditions that impact major Information Technology systems across organizational, geographic, or programmatic lines. Conduct information assurance evaluations of computer systems and logs, information technology methods, controls and strategies, or policies and procedures to ensure confidentiality, integrity, and availability of systems and make recommendations to top level cyber security management on cyber security and investigative matters related to IRS Programs and systems. Participate in the development of new Information Technology Programs or emerging technologies, providing insight or recommendations to protect systems from unauthorized access, use, disclosure, disruption, and modification of taxpayer data. Prepare briefing documents and presents findings of vulnerabilities to TIGTA, IRS, and Treasury cybersecurity executives, IT personnel, and non-IT personnel and recommends changes to policy, procedures, and requirements for IT Security systems Treasury Wide. Promote awareness and alerts of cyber security issues among OI management and ensures sound security principles are reflected in the development of IRS applications and networks. Requirements Conditions of Employment The experience may have been gained in either the public, private sector or volunteer service. One year of experience refers to full-time work; part-time work is considered on a prorated basis. To ensure full credit for your work experience, please indicate dates of employment by month/day/year, and indicate number of hours worked per week on your résumé. Key Requirements: Click "Print Preview" to review the entire announcement before applying. Must be U.S. Citizen or U.S. National All newly appointed employees to the competitive (or excepted) service are subject to a probationary (or trial) period. During this time, your performance, conduct, and suitability for continued employment will be evaluated. You will not automatically convert to permanent status at the end of the probationary (or trial) period. Your supervisor must affirmatively determine that continued employment is in the best interest of the Federal service. If no certification is made before the probationary (or trial) period ends, your appointment will be terminated. You are encouraged to actively engage with your supervisor, seek feedback, and understand role expectations. Additional guidance and support will be provided during onboarding. Qualifications You must meet the following requirements by the closing date of this announcement. Specialized Experience: For the GS-13, you must have one year of specialized experience at a level of difficulty and responsibility equivalent to the GS-12 grade level in the Federal service. Specialized experience for this position includes: Conducts cybersecurity evaluations of Treasury Programs or IT systems to ensure data being processed will support cybercrime investigations; AND Conducts analysis on potential cybersecurity breaches, to include testing and validating application audit trails for accuracy and completeness, makes recommendations to top level management; AND Conducts data mining activities related to Security Information and Event Management (SIEM) software to include data retrieval and analysis; AND Correlates data from various sources used to identify potential cybersecurity breaches in Treasury systems. In addition to meeting specialized experience, individuals must meet proficiency levels in each of the following competencies: Attention to Detail, Customer Service, Decision Making, Information Management, Interpersonal Skills, Oral Communication, Problem Solving, Teamwork, and Technical Competence. A structured interview will be used to determine if you meet the required proficiency levels, wherein you will be interviewed about past experience or hypothetical situations. For the required proficiency levels and competency definitions, please see the following link: Competency-Based Qualification Standard for the Information Technology Management Series, 2210 Time-in-Grade: In addition to the above requirements, you must meet the following time-in-grade requirement, if applicable: For the GS-13, you must have been at the GS-12 level for 52 weeks. Time After Competitive Appointment: Candidates who are current Federal employees serving on a non-temporary competitive appointment must have served at least three months in that appointment. Education Additional Information We may select from this announcement or any other source to fill one or more vacancies. This is a non-bargaining unit position. We offer opportunities for telework. We offer opportunities for flexible work schedules. During the application process you will have an option to opt-in to make your resume available to hiring managers in the agency who have similar positions. Opting in does not impact on your application for this announcement, nor does it guarantee further consideration for additional positions. This job opportunity announcement may be used to fill additional vacancies. CONDITIONS OF EMPLOYMENT (CONTINUED): A one year probationary period may be required. Continued employment is contingent upon supervisory certification that continued employment will benefit the Federal Service; the certification will occur no less than 30 days before the end of the probationary/trial period. Must successfully complete a background investigation. Top Secret/SCI - Background Investigation will be required. Complete a Declaration for Federal Employment to determine your suitability for Federal employment, at the time requested by the agency. You will be required to regularly report to the Duty Station listed above. While teleworking is an option, approval is at management's discretion based on duties, business needs, performance, etc. Have your salary sent to a financial institution of your choice by Direct Deposit/Electronic Funds Transfer. If you are a male applicant born after December 31, 1959, certify that you have registered with the Selective Service System or are exempt from having to do so. Go through a Personal Identity Verification (PIV) process that requires two forms of identification from the Form I-9. Federal law requires verification of the identity and employment eligibility of all new hires in the U.S. Obtain and use a Government-issued charge card for business-related travel. The employment of any candidate, including a current employee or a new hire, selected for this position is conditioned upon review/check of the candidate's tax compliance. Further, all TIGTA employees are subject to an employee tax compliance program to ensure that employees fulfill their personal tax responsibilities. Submit to a drug test prior to your appointment and random drug testing while you occupy the position. Obtain and use a Government-issued charge card for business-related travel. This position requires that the successful candidate undergo personnel vetting, which includes a background investigation and enrollment upon onboarding into "Continuous Vetting." Enrollment in Continuous Vetting will result in automated record checks being conducted throughout one's employment with Treasury. The successful candidate will also be enrolled into FBI's Rap Back service, which will allow Treasury to receive notification from the FBI of criminal matters (e.g., arrests, charges, convictions) involving enrolled individuals in near real-time. For more information about individual rights, Noncriminal Justice Applicant's Privacy Rights - FBI, FD-258 Privacy Act Statement - FBI, and SEAD-3-Reporting-U.pdf (dni.gov).