Summary About the Position: This position is in the Defense Civilian Intelligence Personnel System (DCIPS). Employees occupying DCIPS positions are in the Excepted Service and must adhere to U.S. Code, Title 10, as well as Department of Defense Instruction 1400.25. This position is with the U.S. Army Intelligence and Security Command, Enterprise/Surveillance & Reconnaissance Activity, Enterprise Cybersecurity located at Fort Belvoir, Virginia. Responsibilities Provide strategic direction and operational leadership for enterprise-wide defensive cyber operations activities to protect critical networks, systems, and data against evolving threats. Lead enterprise security operations and computer network defense, overseeing continuous monitoring, threat analysis, and the implementation of comprehensive cybersecurity policies and defensive capabilities to ensure mission resilience. Spearhead improvement of the organization's defensive posture by guiding vulnerability assessments, influencing secure system architecture, overseeing the tuning of defensive tools, and integrating threat intelligence into daily operations. Direct all incident response activities, providing authoritative leadership and technical oversight for the timely investigation, containment, mitigation, and recovery from cyber incidents across the enterprise. Provide senior leaders with clear, timely updates on incident trends, enterprise security posture, and recommended improvements to strengthen overall cyber defense readiness. Requirements Conditions of Employment Qualifications As part of the assessment process, your resume will be evaluated using a competency-based method. This structured evaluation measures your qualifications, experience, and skills against the core competencies required for the position. Final scores will determine whether you are referred to the Hiring Manager for further consideration. Who May Apply: Only applicants who meet one of the employment authority categories below are eligible to apply for this job. You will be asked to identify which category or categories you meet, and to provide documents which prove you meet the category or categories you selected. See Proof of Eligibility for an extensive list of document requirements for all employment authorities. 10-Point Other Veterans' Rating 30 Percent or More Disabled Veterans 5-Point Veterans' Preference Current Army Defense Civilian Intelligence Personnel System (DCIPS) Employee Current Department of Army Civilian Employees Current Department of Defense (DOD) Civilian Employee (non-Army) Current DoD Defense Civilian Intelligence Personnel System (DCIPS) Employee (non-Army) Defense Civilian Intelligence Personnel System (DCIPS) Interchange Agreement Disabled Veteran w/ a Service-Connected Disability, More than 10%, Less than 30% Non-Department of Defense (DoD) Transfer Prior Federal Service Employee Priority Placement Program, DoD Military Reserve (MR) and National Guard (NG) Technician Eligible Priority Placement Program, DoD MR and NG Preference Eligible Tech Receiving Disability Retirement Priority Placement Program, DoD Retained Grade Preference Eligible United States Citizen Applying to a DCIPS Position Army DCIPS positions apply Veteran's Preference to preference eligible candidates as defined by Section 2108 of Title 5 U.S.C., in accordance with the procedures provided in DoD Instruction 1400.25, Volume 2005, DCIPS Employment and Placement. In order to qualify, you must meet the experience requirements described below. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community; student; social). You will receive credit for all qualifying experience, including volunteer experience. Your resume must clearly describe your relevant experience; if qualifying based on education, your transcripts will be required as part of your application. Additional information about transcripts is in this document. Basic Requirement for Supervisory Information Technology (Information Security): Specialized and Other Experience: Specialized Experience: One year of specialized experience which includes: Conducting continuous monitoring and analysis of network activity to identify anomalies, validate alerts, and distinguish malicious behavior from normal operations; and Evaluating alerts, correlating events from multiple sources, and conducting comprehensive log and traffic analysis to determine the scope, urgency, and operational impact of potential threats; and Assisting in the development of defensive techniques, guidance, after action reviews; and Performing incident response operations (such as investigation, analysis, containment, mitigation, and recovery) of cyber incidents across the network environment; and Developing detection logic, defensive tool content, and signatures, ensuring detection and response technologies are properly tuned, maintained, and integrated to support capability development and modernization; and Performing system, network vulnerability and threat assessments informing leadership of cybersecurity and operational risk, recommending, and validating corrective actions and ensuring defensive controls effectively reduce risk. This definition of specialized experience is typical of work performed at the next lower grade/level position in the federal service (GS/GG-13). The specialized experience must include, or be supplemented by, information technology related experience (paid or unpaid experience and/or completion of specific, intensive training, as appropriate) which demonstrates each of the four competencies, as defined: (1) Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Examples of IT-related experience demonstrating this competency include: leading others by setting the standards for the quality of work, even in the most difficult and/or high pressure circumstances; reviewing and editing work completed by others to ensure that the quality of work meets acceptable work standards. (2) Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Examples of IT-related experience demonstrating this competency include: using expertise and experience to address complex problems, questions, or complaints; anticipating customer needs and modify the team's work activities, processes, and practices to meet these needs; collaborating across team and outside of own team to organize planning sessions that elicit ideas for improving customer service and support. (3) Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Examples of IT-related experience demonstrating this competency include: clearly explaining and defending complex ideas, appropriately adapting to each audience's level of knowledge; actively listening and clarifying points when presenting highly complex and controversial findings; using well-constructed, fact-based arguments to persuade stakeholders/officials to take action on suggestions for improvement. (4) Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. Examples of IT-related experience demonstrating this competency include: providing precedent setting solutions to unique problems not previously encountered; helping team make decisions which are complicated by the number and nature of existing policy, guidelines, and organizational goals; identifying the root causes of problems; developing systemic solutions to address them and prevent them from reoccurring. You will be evaluated on the basis of your level of competency in the following areas: Cybersecurity Information Technology Policy and Planning Leadership Problem Solving Technical Competence Education Additional Information In accordance with DoDM 8140.03 and supplemental Army guidance, the employee must obtain and maintain the following requirements for each Cyber work role (except Data, AI, and/or Software Engineering) at the assigned proficiency level: 1) Foundational qualification requirements within 9 months, 2) Resident qualification requirements within 12 months, 3) 20 hours of Continuous Professional Development (CPD) per work role code (which can overlap). This position requires a 2 year trial period during which the agency evaluates your fitness and whether your continued employment advances the public interest. In making this determination, the agency may consider your performance and conduct; agency needs and interests; whether your continued employment supports organizational or Government goals; and whether it promotes the efficiency of the Federal service. Continued employment requires written certification that it advances the public interest. Male applicants born after December 31, 1959, must complete a Pre-Employment Certification Statement for Selective Service Registration. You will be required to provide proof of U.S. Citizenship. Direct Deposit of Pay is required. Must be able to obtain and maintain a Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance. Selection is subject to restrictions resulting from Department of Defense referral system for displaced employees. If you have retired from federal service and you are interested in employment as a reemployed annuitant, see the information in the Reemployed Annuitant information sheet. This is a(n) Technology Career Field position. Multiple positions may be filled from this announcement. Salary includes applicable locality pay. When you perform a Civilian Permanent Change of Station (PCS) with the government, the Internal Revenue Service (IRS) considers the majority of your entitlements to be taxable. Visit https://www.dfas.mil/civilianemployees/civrelo/Civilian-Moving-Expenses-Tax-Deduction/ for more information. Permanent Change of Station (PCS) allowances may be authorized, subject to the provisions of the Joint Travel Regulations and an agency determination that a PCS move is in the Government Interest. Recruitment, retention, and/or relocation incentive, advance in-hire rates, and creditable service for leave accrual may be authorized when determined to be in the best interest of the government. As a supervisor, you must comply with the Army Civilian Education System (CES) course and timeline requirements. The Supervisory Development Course (SDC) must be completed within one year of placement into a supervisory position, to include those with supervisory duties less than 25% of the position. For information on CES, please visit the following website: https://armyuniversity.edu/amsc/EducationalPrograms#sd
