Chief Information Security Officer

Summary

As the Chief Information Security Officer with the U.S. Office of Personnel Management, Office of the Chief Information Officer, you will direct agency-wide cybersecurity policies, risk management, security engineering, incident response, and supply chain security programs while managing resources to protect agency systems and information.

Duties

• Direct agency-wide cybersecurity policies, data classification standards, and security requirements governing information systems, emerging technologies, and secure software development. Oversee cybersecurity governance, risk assessments, security authorization recommendations, compliance monitoring, vulnerability remediation, and responses to audits and oversight requirements. Direct the agency's supply chain risk management program, including assessments of third-party security risks, acquisition security requirements, and software supply chain protections. Manage the embedded security engineering program, establishing security review processes, engineering standards, and safeguards throughout the system development lifecycle. Lead agency-wide cybersecurity incident response, including incident declarations, containment and recovery coordination, required reporting, and corrective action tracking. Supervise cybersecurity personnel through subordinate supervisors and team leads, including performance management, staffing, employee development, and workforce planning. Manage cybersecurity program budgets, contracts, and resources; advise senior leadership on security risks; and represent the agency in government-wide cybersecurity initiatives

Qualifications

To qualify for the Supervisory IT Cybersecurity Specialist (Chief Information Security Officer), GS-2210-15, position, you must demonstrate the competencies and specialized experience necessary to perform the duties of the position. Specialized Experience Applicants must demonstrate specialized experience equivalent to at least the GS-14 level in the Federal service, or equivalent, performing information technology cybersecurity work that includes: Developing or implementing organizational cybersecurity policies, security standards, and technical controls to protect information systems and data; Managing cybersecurity governance, risk management, and compliance activities, including evaluating security risks, reviewing security assessments, and recommending risk mitigation actions; Directing or coordinating cybersecurity engineering activities, including integrating security requirements and controls into information systems, cloud environments, or software development processes; Leading cybersecurity incident response activities, including coordinating incident investigations, containment, recovery, reporting, and corrective actions; and Managing cybersecurity programs or organizational functions, including establishing program priorities, overseeing personnel or technical teams, and allocating resources to accomplish security objectives. Required Competency & Minimum Level Attention to Detail-Level 4 Customer Service-Level 4 Decision Making-Level 3 Information Management-Level 4 Interpersonal Skills-Level 4 Oral Communication-Level 3 Problem Solving-Level 4 Teamwork-Level 4 Technical Competence-Level 4 You must meet all qualification and eligibility requirements by the closing date of this announcement. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.