SECURITY SPECIALIST (INSIDER THREAT)

Duties
Help

As a SECURITY SPECIALIST (INSIDER THREAT) at the GS-0080-13 some of your typical work assignments may include:

• Serves as a technical expert for the Insider Threat Program, responsible for the analysis of data from various sources to identify anomalous behavior and potential threats. Utilizes User Activity Monitoring (UAM) tools, security information and event management (SIEM) systems, and other data analytic platforms to detect and flag potential insider threat indicators.
• Conducts complex inquiries and preliminary investigations into potential insider threat matters. This involves correlating data from multiple sources (e.g., personnel records, system logs, security reports, and counterintelligence data) to assess the credibility and severity of a potential threat.
• Prepares detailed reports of analysis and inquiries, documenting findings and providing recommendations for further investigation or other mitigating actions. Liaises with counterintelligence (CI) investigators, law enforcement, and other security professionals to transition cases when established thresholds are met.
• Maintains deep knowledge of cyber attacker methodologies and intrusion stages to recognize patterns and correlate incident data to specific vulnerabilities.
• Develops, implements, and evaluates the effectiveness of the organization's Insider Threat Program policies and procedures.
• Formulates and recommends changes to policies, standards, and procedures based on new threats, technologies, or regulatory requirements. Establishes criteria for identifying and analyzing trends in security violations and measures program effectiveness.
• Serves as a subject matter expert on insider threat matters, providing authoritative advice and guidance to senior leadership, program managers, and other personnel. Represents the organization in working groups, committees, and conferences related to insider threat.
• Conducts comprehensive risk and vulnerability assessments of systems, processes, and personnel to identify potential avenues for exploitation by an insider.
• Analyzes proposed changes in mission, organizational structure, or technology to assess their impact on the insider threat posture. Recommends security controls and countermeasures to mitigate identified risks.
• Coordinates with IT and cybersecurity personnel to ensure that system and network hardening techniques are in place and effective against insider threats.
• Develops and delivers insider threat awareness training and education programs for the workforce.
  This includes initial briefings for new personnel, annual refresher training, and specialized training for supervisors and personnel in critical or sensitive roles.
• Creates and disseminates awareness materials (e.g., newsletters, posters, briefings) to promote a culture of security and vigilance throughout the organization.

Requirements
Help
Conditions of employment

• Must be a U.S. citizen
• Males born after 12-31-59 must be registered for Selective Service
• Resume and supporting documents (See How To Apply)
• Suitable for Federal employment, determined by a background investigation
• May be required to successfully complete a probationary period
• Work Schedule: Full Time
• Overtime/compensatory time may be required to accommodate operational needs of the organization.
• Tour of Duty: Flexible
• Recruitment Incentives: May Be Authorized
• Fair Labor Standards Act (FLSA): Exempt
• Financial Disclosure: Not Required
• Telework Eligibility: This position may be eligible for limited, situational telework subject to supervisory approval and not to exceed current Agency guidelines. This position is not eligible for remote telework.
• Must be able to obtain and maintain a TOP SECRET w/SCI security clearance.
• Must consent to and pass pre-employment drug testing and be subject to periodic random drug testing thereafter.
• Travel in the performance of temporary assignments may be required- 10% CONUS/OCONUS. Valid Passport is required.
• The employee must be willing to comply with each Combatant Command (COCOM) travel medical requirement to include vaccinations.
• May be subject to random DoD counterintelligence scope polygraph if assigned to programs or duty locations requiring such.
• Incumbent must possess the SPeD Security Fundamentals Professional Certification (SFPC) or obtain the certification within 24 months of hire and maintain annual certifications thereafter.
• Incumbent must possess the Counter-InTP Fundamentals and Analysis certifications within 24 months of hire and maintain annual certifications thereafter.

Qualifications

You may qualify at the GS-13, if you fulfill the following qualifications:

A. One year of specialized experience equivalent to the GS-12 grade level in the Federal service:

• Conducting independently insider threat, security, counterintelligence and/or force protection briefings to senior leadership.
• Providing security, insider threat and counterintelligence support to Department of War operations and activities.
• Conducting research and analysis on matters of insider threat, security, counterintelligence or force protection concern.
• Conducting insider threat, security, counterintelligence and/or assessments in reference to risk management.

Education

Substitution of education may not be used in lieu of specialized experience for this grade level.

Additional information

Veterans Employment Opportunity Act (VEOA): To be eligible for a VEOA appointment under Merit Promotion procedures, the veteran must be a preference eligible or a veteran separated after 3 years or more of continuous active service performed under honorable conditions.

Interagency Career Transition Assistance Programs: This program applies to employees who have been involuntarily separated from a Federal service position within the competitive service or Federal service employees whose positions have been deemed surplus or no longer needed. To receive selection priority for this position, you must: 1) meet ICTAP eligibility criteria; 2) be rated well-qualified for the position; Well qualified is defined as possessing the type and quality of experience that exceeds the positions minimum qualifications. and 3) submit the appropriate documentation to support your ICTAP eligibility. For more information: https://www.opm.gov/policy-data-oversight/workforce-restructuring/employee-guide-to-career-transition/ .

Noncompetitive Appointment Authorities: For more information on noncompetitive appointment authority eligibility requirements:
Persons with Disabilities - Schedule A

Males born after 12-31-59 must be registered or exempt from Selective Service (see https://www.sss.gov/register/ )

The selecting official may choose to conduct interviews, and once the selection is made, you will receive a notification of the decision.
NOTE: Declining to be interviewed or failure to report for a scheduled interview will be considered as a declination for further consideration for employment against this vacancy.

Selective Service Requirement: Please visit http://www.sss.gov for more information.

For more information, please visit
https://www.dla.mil/Portals/104/Documents/Careers/downloads/DoDGenAppInfo%2012-1-2020.pdf?ver=ECNbdsHtGilTd3OENN4A0Q%3d%3d

Other Notes:

Re-employed Annuitant: This position DOES NOT meet criteria for re-employed annuitant. The DoD criteria for hiring Re-employed Annuitants can be found at:
https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/140025/1400.25-V300.pdf

Status candidates must meet time-in-grade requirements (52 weeks at the next lower grade level).