Information Technology Specialist (INFOSEC)

Summary

Organizational Location: This position is with the Department of Homeland Security, within U.S. Customs and Border Protection, Office of Information & Technology/Cyber Security Directorate/Security Operations Division located in Ashburn, VA.

Duties

This CBP OIT Cybersecurity Directorate position supports the security of CBP's information systems, networks, facilities, and communications technologies. The role focuses on protecting the confidentiality, integrity, and availability of data and systems by planning, implementing, maintaining, and improving cybersecurity programs, policies, procedures, and tools. This position starts at a salary of $143,913.00 (GS-14, Step 1) to $187,093.00 (GS-14, Step 10). Major duties include: Developing and delivers briefings to CBP Senior Leaders on threat hunting leads and trends, associated with CBP Mission Essential Systems and High Value Assets as well as develop metrics displaying the various trends of TTPs, IOCs and IOAs discovered on CBP networks and assets. Leading the development of alerts, reports, metrics and briefings on cyber threat indicators/indications, threat intelligence, and attack trends. Synthesizes and places intelligence information into context; draws insights about the possible implications. Leading research and evaluations of technical and all-source intelligence to develop in-depth analysis and assessment on threats to systems, critical networks and critical infrastructure. The incumbent will manage all-source research to determine adversary capability, intent, and prioritization. Notifying designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan. Conducting hypothesis-driven investigations triggered by threat intelligence and collected attack data, giving insights into attackers' latest tactics, techniques, and procedures (TTP) and discover if the attacker's specific behaviors are found within CBP's environment. Requirements

You must be a U.S. Citizen to apply for this position Males born after 12/31/1959 must be registered with Selective Service Primary U.S. residency for at least three of the last five years (additional details below) All pre-employment processes will be conducted in English You may be required to pass a background investigation CBP follows the DHS Drug-Free Workplace Plan for drug testing procedures As an employee of CBP, you will be joining a workforce that is dedicated to accomplishing our mission while maintaining the trust of our Nation by strictly adhering to all government ethics standards. Your conduct will be subject to the ethics rules applicable to all Executive Branch employees, and to CBP employees specifically, as well as the criminal conflict of interest statutes. Once you enter on duty, these rules include obtaining approval for outside employment or business activity, to ensure such employment or business activity is not prohibited and does not interfere or conflict with performance of your official duties. Please review further details via the following link. DHS uses E-Verify, an Internet-based system, to confirm the eligibility of all newly hired employees to work in the United States. Learn more about E-Verify including your rights and responsibilities. Bargaining Unit: This position is not covered under the bargaining unit. Qualifications

Basic Requirement: Individuals must have IT-related experience demonstrating each of the four competencies listed below. Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. You qualify for this position if you meet the basic requirement listed above and possess one year of specialized experience as described below. Experience: You qualify for the GS-14 grade level if you possess 1 year of specialized experience equivalent to at least the next lower grade level, performing duties such as: Utilizing enterprise cybersecurity tools to identify, contain, and mitigate advanced threats and cyber intrusions. Analyzing technical evidence across the cyber kill chain and MITRE ATT&CK framework. Skilled at correlating forensic artifacts, indicators of compromise, and threat intelligence from network and host systems to identify adversary tactics, techniques, and procedures. Analyzing at senior-level large volumes of cybersecurity logs from multiple sources to identify hidden malicious activity, lateral movement, and unusual behavior that may bypass traditional security controls. Incorporating cyber threat intelligence and attribution information into threat-hunting activities; leading incident-response triage; preparing technical threat reports; and communicating cyber risks and recommended actions to operational teams and senior leadership. NOTE: Your resume must explicitly indicate how you meet this requirement, otherwise you will be found ineligible. Please see the "Required Documents" section below for additional resume requirements. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. You must meet all qualification requirements, including education if applicable to this position, subject to verification at any stage of the application process by 10/30/2026. The Office of Personnel Management (OPM) must authorize employment offers made to current or former political appointees. If you are currently, or have been within the last 5 years, a political Schedule A, Schedule C, Non-career SES or Presidential Appointee employee in the Executive Branch, you must disclose this information to the Human Resources Office. Background Investigation: U.S. Customs and Border Protection (CBP) is a federal law enforcement agency that requires all applicants to undergo a thorough background investigation prior to employment in order to promote the agency's core values of vigilance, service to country, and integrity. During the screening and/or background investigation process, you will be asked questions regarding any felony criminal convictions or current felony charges, the use of illegal drugs (e.g., marijuana, cocaine, heroin, LSD, methamphetamines, ecstasy), and the use of non-prescribed controlled substances including any experimentation, possession, sale, receipt, manufacture, cultivation, production, transfer, shipping, trafficking, or distribution of controlled substances. For additional information on the preemployment process, review the following link: Applicant Resources | CBP Careers Residency: There is a residency requirement for all applicants not currently employed by CBP. Individuals are required to have physically resided in the United States or its protectorates (as declared under international law) for at least three of the last five years. If you do not meet the residency requirement and you have been physically located in a foreign location for more than two of the last five years, you may request an exception to determine if you are eligible for a residency waiver by meeting one or more of the following conditions: Working for the U.S. Government as a federal civilian or as a member of the military A dependent who was authorized to accompany a federal civilian or member of the military who was working for the U.S. government Participation in a study abroad program sponsored by a U.S. affiliated college or university Working as a contractor, intern, consultant or volunteer supporting the U.S. government Probationary Period: All employees new to the federal government must serve a one year probationary period during the first year of his/her initial permanent federal appointment to determine fitness for continued employment. Current and former federal employees may be required to serve or complete a probationary period.

Education

Please see the Qualifications and Required Documents sections for more information if education is applicable to this position. How You Will Be Evaluated

This position is being filled under a Direct Hire Authority. We will review your resume and supporting documentation to ensure you meet the minimum qualification requirements. All applicants who meet minimum qualifications and any basic requirements applicable to this position, will be forwarded to the hiring manager for consideration and may be contacted for an interview. As a part of the interview process, additional selection criteria may be administered by the hiring manager. This self-assessment will be used to assess the following competencies or knowledge, skills, and abilities (KSA's) needed to perform this job are: Knowledge of what constitutes a "threat" to a network to understand what has the capabilities to impact the network and identify mitigations in support of mission functions. Skill in developing analytic solutions to situations for which information is incomplete to enable continued mission support. Knowledge of techniques for detecting host and network-based intrusions to detect potential intrusions and recommend mitigations in support of the mission. Ability to determine how a security system should work (including its resilience and dependability capabilities) to determine how changes in conditions, operations, or the environment will affect the mission and to create and lead the implementation of security programs through a lifecycle, and across platforms. Knowledge of cyber-attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks) to identify at what stage an attack is taking place enabling the proper reporting to support the mission and total infrastructure protection environment. Veterans: Veterans preference does not apply to selections made using the Direct Hire Authority. Veteran applicants will be considered along with all other applicants who apply. Agency Career Transition Assistance Program (CTAP) or the Interagency Career Transition Assistance Program (ICTAP) Eligibles: If you have never worked for the federal government, you are not CTAP/ICTAP eligible. View information about CTAP/ICTAP eligibility on OPM's Career Transition Resources website. To be considered under CTAP/ICTAP, you must have knowledge, skills, abilities and/or competencies as defined above which clearly exceed the minimum qualification and any applicable basic requirements for the vacancy. In addition, you must submit the supporting documents listed under the Required Documents section of this job announcement. Other Information

The vacancy questionnaire includes four short, free-response essay questions. This provides an opportunity for you to highlight your dedication to public service for the hiring manager and agency leadership (or designee(s)). While your responses are not required and will not be scored, we encourage you to thoughtfully address each question. Please provide a response of 200 words or less to each question. You will be asked to certify that you are using your own words and did not use a consultant or Super Intelligence (SI) such as a large language model (LLM) like ChatGPT or Copilot. https://apply.usastaffing.gov/ViewQuestionnaire/13091146 Security Clearance: You may be required to obtain TS/SCI or higher level clearance for this position. The Department of Homeland Security encourages persons with disabilities to apply, to include persons with intellectual, severe physical or psychiatric disabilities, as defined by 5 CFR § 213.3102(u), and/or Disabled Veterans with a compensable service-connected disability of 30 percent or more as defined by 5 CFR § 315.707. Veterans, Peace Corps/VISTA volunteers, and persons with disabilities possess a wealth of unique talents, experiences, and competencies that can be invaluable to the DHS mission. If you are a member of one of these groups, you may not have to compete with the public for federal jobs. To determine your eligibility for non-competitive appointment and to understand the required documentation, click on the links above or contact the Servicing Human Resources Office listed at the bottom of this announcement.