Information Technology Specialist (INFOSEC)

Organizational Location: This position is with the Department of Homeland Security, within U.S. Customs and Border Protection, Office of Information & Technology/Cyber Security Directorate/Security Operations Division located in Ashburn, VA. Major duties: This CBP OIT Cybersecurity Directorate position supports the security of CBP's information systems, networks, facilities, and communications technologies. The role focuses on protecting the confidentiality, integrity, and availability of data and systems by planning, implementing, maintaining, and improving cybersecurity programs, policies, procedures, and tools. This position starts at a salary of $143,913.00 (GS-14, Step 1) to $187,093.00 (GS-14, Step 10). Major duties include: Developing and delivers briefings to CBP Senior Leaders on threat hunting leads and trends, associated with CBP Mission Essential Systems and High Value Assets as well as develop metrics displaying the various trends of TTPs, IOCs and IOAs discovered on CBP networks and assets. Leading the development of alerts, reports, metrics and briefings on cyber threat indicators/indications, threat intelligence, and attack trends. Synthesizes and places intelligence information into context; draws insights about the possible implications. Leading research and evaluations of technical and all-source intelligence to develop in-depth analysis and assessment on threats to systems, critical networks and critical infrastructure. The incumbent will manage all-source research to determine adversary capability, intent, and prioritization. Notifying designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan. Conducting hypothesis-driven investigations triggered by threat intelligence and collected attack data, giving insights into attackers' latest tactics, techniques, and procedures (TTP) and discover if the attacker's specific behaviors are found within CBP's environment. Qualifications: Basic Requirement: Individuals must have IT-related experience demonstrating each of the four competencies listed below. Attention to Detail - Is thorough when performing work and conscientious about attending to detail. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. You qualify for this position if you meet the basic requirement listed above and possess one year of specialized experience as described below. Experience: You qualify for the GS-14 grade level if you possess 1 year of specialized experience equivalent to at least the next lower grade level, performing duties such as: Utilizing enterprise cybersecurity tools to identify, contain, and mitigate advanced threats and cyber intrusions. Analyzing technical evidence across the cyber kill chain and MITRE ATT&CK framework. Skilled at correlating forensic artifacts, indicators of compromise, and threat intelligence from network and host systems to identify adversary tactics, techniques, and procedures. Analyzing at senior-level large volumes of cybersecurity logs from multiple sources to identify hidden malicious activity, lateral movement, and unusual behavior that may bypass traditional security controls. Incorporating cyber threat intelligence and attribution information into threat-hunting activities; leading incident-response triage; preparing technical threat reports; and communicating cyber risks and recommended actions to operational teams and senior leadership. NOTE: Your resume must explicitly indicate how you meet this requirement, otherwise you will be found ineligible. Please see the "Required Documents" section below for additional resume requirements. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. You must meet all qualification requirements, including education if applicable to this position, subject to verification at any stage of the application process by 10/30/2026. The Office of Personnel Management (OPM) must authorize employment offers made to current or former political appointees. If you are currently, or have been within the last 5 years, a political Schedule A, Schedule C, Non-career SES or Presidential Appointee employee in the Executive Branch, you must disclose this information to the Human Resources Office. Background Investigation: U.S. Customs and Border Protection (CBP) is a federal law enforcement agency that requires all applicants to undergo a thorough background investigation prior to employment in order to promote the agency's core values of vigilance, service to country, and integrity. During the screening and/or background investigation process, you will be asked questions regarding any felony criminal convictions or current felony charges, the use of illegal drugs (e.g., marijuana, cocaine, heroin, LSD, methamphetamines, ecstasy), and the use of non-prescribed controlled substances including any experimentation, possession, sale, receipt, manufacture, cultivation, production, transfer, shipping, trafficking, or distribution of controlled substances. For additional information on the preemployment process, review the following link: Applicant Resources | CBP Careers Residency: There is a residency requirement for all applicants not currently employed by CBP. Individuals are required to have physically resided in the United States or its protectorates (as declared under international law) for at least three of the last five years. If you do not meet the residency requirement and you have been physically located in a foreign location for more than two of the last five years, you may request an exception to determine if you are eligible for a residency waiver by meeting one or more of the following conditions: Working for the U.S. Government as a federal civilian or as a member of the military A dependent who was authorized to accompany a federal civilian or member of the military who was working for the U.S. government Participation in a study abroad program sponsored by a U.S. affiliated college or university Working as a contractor, intern, consultant or volunteer supporting the U.S. government Probationary Period: All employees new to the federal government must serve a one year probationary period during the first year of his/her initial permanent federal appointment to determine fitness for continued employment. Current and former federal employees may be required to serve or complete a probationary period.