Job Summary

This position is in the U.S. Department of Education (ED), Federal Student Aid (FSA), Technology Directorate (TD). The Technology Directorate provides information technology services for all FSA systems, promoting the effective and secure use of technology to achieve FSA's strategic objectives through sound planning, investments, integrated technology architectures and standards, effective systems development, production support, and cybersecurity services.

Job Description

Specialized Experience for the GS-14: One year of experience in either federal or non-federal service that is equivalent to at least a GS-13 performing two (2) out of three (3) of the following duties or work assignments: Experience coordinating Pen Testing, Red Team, and Purple Team exercises, testing defenses against simulated attacks, applying threat intelligence, and updating playbooks to continuously develop the SOC analytics capabilities. Experience in managing a SOC, leading advanced cyber incident triage and response efforts, including detection, investigation, containment, eradication, and recovery, for complex security events such as APTs and data exfiltration attempts, while documenting findings, ensuring alignment with Incident Response (IR) plans and NIST SP 800-61r2, improving SOC workflows, Standard Operating Procedures (SOP)s, and playbooks. Experience in conducting continuous, risk-based vulnerability management, overseeing cyber-hygiene and CDM scans to enforce enterprise-wide baseline security posture. Basic Experience Requirements: You must possess IT related experience (paid or unpaid experience and/or completion of specific, intensive training (e.g., IT certification), as appropriate) demonstrating each of the four competencies listed below. Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Customer Service - Works with clients and customers (i.e., any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Oral Communication - Expresses information (e.g., ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (e.g., technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. Knowledge, Skills, and Abilities (KSAs): The quality of your experience will be measured by the extent to which you possess the following knowledge, skills and abilities (KSAs). You do not need to provide separate narrative responses to these KSAs, as they will be measured by your responses to the occupational questionnaire (you may preview the occupational questionnaire by clicking the link at the end of the Evaluations section of this vacancy announcement). Knowledge of the Cyber Kill Chain, MITRE ATT&CK framework, and common attack methodologies. Expertise in SIEM, EDR, Web Application Firewall (WAF), forensics methodology, and threat intelligence. Knowledge of attacker frameworks (MITRE ATT&CK), the skill to hunt through complex data for hidden threats, and the ability to translate technical findings into business risk, and the ability to facilitate collaboration between Red and Blue teams. Skill in SIEM systems, EDR, including their configuration and optimization, expertise in forensics, pen testing, integrating threat intelligence feeds and managing cyber hygiene initiatives. Ability to communicate complex technical risks clearly to executive and non-technical audiences, think strategically about security operations to align them with business objectives, and apply strong root cause analysis to drive effective decision-making and continuous improvement.