IT Cybersecurity Specialist (INFOSEC)

To qualify for this position, applicants must meet all requirements by the closing date of this announcement, 11/19/2026. You must meet the Minimum Qualification Requirements, Specialized Experience and Selective Placement Factors to qualify for this series as described below. Minimum Qualifications Requirements: To qualify for this position, you must have information technology-related experience demonstrating all of the four competencies listed below.

Ensure that this experience is clearly described in your resume: Attention to Detail - Is thorough when performing work and conscientious about attending to detail.

Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services.

Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately.

Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. -AND- Specialized Experience: You must have one year of specialized experience equivalent to at least the next lower grade in the normal line of progression for the occupation in the organization.

Specialized experience is experience that has equipped the applicant with the particular competencies/knowledge, skills, and abilities to successfully perform the duties of the position and is typically in or related to the work of the position to be filled. Such experience is typically gained in the IT field or through the performance of work where the primary concern is IT.

Specialized experience for this position is defined as applying IT security principles, policies, and procedures to protect networks, systems, and devices, which includes: conducting risk assessments and authorization/accreditation activities for complex information systems; developing or recommending IT security policies, controls, or countermeasures based on risk assessment findings; communicating technical security analysis and recommendations to all levels of organizational leadership; and conducting research risk assessments for research studies. -AND- Selective Placement Factor: This position includes a skill, knowledge, ability or other worker characteristic basic to, and essential for, satisfactory performance of the job.

Selective Placement Factors are a prerequisite to appointment and represent minimum requirements for a position. Applicants who do not meet it are ineligible for further consideration.

Selective Placement Factors for this position is defined as experience with applying system development life cycle management concepts sufficient to performance monitoring of complex risk management of IT networks, systems and specialized medical equipment as related to Federal Information Security Management to support security review assessments, Risk Management Framework (RMF), and compliance requirements to ensure compliance with VA secure configuration guides and applicable Federal security policies based on National Institute of Standards and Technology (NIST) standards and Federal policies.

Experience applying the NIST Risk Management Framework (RMF) to assess, authorize, and secure networked systems, devices, or special purpose systems within a healthcare, research, or similarly complex federal IT environment. Evidence of all of these requirements must be reflected in your resume.

For more information on these qualification standards, please visit the United States Office of Personnel Management's website at https://www.opm.gov/policy-data-oversight/classification-qualifications/general-schedule-qualification-standards/.

Provides expert security advice and consultation in the implementation and risk management of IT networks, systems, and devices to ensure controlled accessibility and security compliance, as well as prevent and defend against unauthorized access to systems, networks, and data. Administers and monitors the division's implementation of the Risk Management Framework (RMF) steps and activities throughout system life cycle.

Ensures the confidentiality, integrity, and availability of networks, systems, devices, and data through the planning, analysis, development, implementation, maintenance and enhancement of information systems security program policies, procedures, and tools. Uses data collected from a variety of cyber defense tools to analyze events that occur within their environments for the purposes of mitigating threats.

Assists in the implementation of programs to ensure the safeguarding of systems, networks, and devices, and data users are aware of, understand, and adhere to systems security policies and procedures. Supports the implementation of information technology (IT) security controls, security authorization documents, and participates in system audits.

Leads teams in conducting comprehensive program studies and evaluations to assure the continuous operations of IT networks/systems/devices and adherence to established Federal regulations and VA policies and procedures to prevent unauthorized access and data compromise. Investigates cyber security incidents for IT networks, systems, and devices to identify possible break of security policies and/or other violations.

Establishes and implements enterprise research cybersecurity programs that support unique and complex research projects and collaborative studies. Conduct risk assessments for all VA/VHA network connected medical devices and associated healthcare systems, medical security boundaries, and Special Purpose Systems.

This position is primarily aligned to the following NICE Cybersecurity Workforce Framework work roles: 722: Information Systems Security Manager: Responsible for the cybersecurity of a program, organization, system, or enclave. 805: IT Program Auditor: Conducts system, network, and device security control assessments, audits, and reviews, and develops security contingency, disaster recovery, and cybersecurity incident response plans and procedures.

511: Cyber Defense Analyst: Uses data collected from a variety of cyber defense tools to analyze events that occur within their environments for the purposes of migrating threats.

For more information about these work roles, where they fit within the larger Cyber Workforce, and how they can support your unique career journey, please visit the Cyber Career Pathways tool on the National Initiative for Cybersecurity Careers and Studies website: https://niccs.cisa.gov/tools/cyber-career-pathways-tool Position Description/PD#: IT Cybersecurity Specialist (INFOSEC)/PD17918A Work Schedule: Monday - Friday; 8:00am-4:30pm Compressed/Flexible: As determined by the Agency Policy.

Telework: ADHOC/Situational. Virtual: This is not a virtual position. Remote: This is not a remote position. Relocation/Recruitment Incentives: Not authorized. Permanent Change of Station (PCS): Not authorized. Travel Required: 25% or less. Bargaining Unit: No Physical Demands: The work is sedentary. Some work may require walking and standing in conjunction with travel and to attendance at meetings and conferences away from the work site. No special physical demands are required to perform the work.

Work Environment: The work is performed in an adequately lighted and climate controlled office environment which involves everyday risks or discomforts that require normal safety precauations.