Supervisory IT Cybersecurity Specialist (Direct Hire)

This position is in the Division of Administration (DA) in the Information Technology (IT) Branch, Cybersecurity Section. This position serves as the Chief Information Security Officer (CISO) reporting to the Chief Information Officer (CIO).

As the CISO, the incumbent is responsible for managing and overseeing the Commission's Cybersecurity compliance and operations units’ activities to ensure compliance with best practices and keep pace with emergent cybersecurity threats. Duties may include: Manage strategic planning and roadmap for the entire cybersecurity program to include strategic/contingency plans for Cyber Incidents of all likely scales and types and perform reviews and testing updates per CIO direction.

Plans and oversees formal assessments of Information Systems, mitigate risk through managing the Assessment and Authorization (A&A) process for assuring that existing and new IT systems meet organization’s cybersecurity and risk requirements. Oversee the preparation of Authority to Operate (ATO) packages for Authorizing Official’s signature.

Ensure CISO programs and initiatives are strategically aligned and communicated throughout the Commission through evaluation of adequacy for the Commission’s IT security controls and systems. Conduct and support routine internal and external security assessments, tabletop exercises, penetration tests, and playbook development to proactively test the effectiveness of the CFTC's IT Cybersecurity Program.

Responsible for CFTC’s Cybersecurity Program annual budget report to Congress in highlighting the Commission’s progress for meeting mission goals and protecting the agency’s information and IT systems. Establishes a comprehensive and effective IT Cybersecurity Program in compliance with Federal laws and regulations by implementing, and managing IT policies, guidelines, standards, processes and management controls, a Mitigates risk through managing the assessment and authorization process for assuring existing and new IT systems meet organization’s cybersecurity and risk requirements.

Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an IT system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37). In case of a cybersecurity incident, the response leads by following established crisis management and plans and communicating laterally and vertically as required.

Uses mitigation, preparedness, and response and recovery approaches, as needed, to optimize the information security posture of the Commission. Conducts regular crisis management exercises to validate agency response plans. Engage with other external organizations to seek and identify opportunities for sharing best practices, strategies, resources and capabilities in support of the development and implementation of an innovative and effective program appropriate to a Federal financial regulatory agency.

In addition to meeting the competency requirement listed in the requirements section of this announcement, you must have at least one year of specialized experience at the next lower GS grade level (or equivalent). Specialized experience is experience that has equipped you with the specific competencies/knowledge, skills, and abilities to successfully perform the duties of the position and is typically in or related to the work of the position to be filled.

Such experience is typically gained in the IT field or through the performance of work where the primary concern is IT. CT-15 Level: To qualify for the CT-15 level you must have at least one year of specialized experience equivalent to the next lower grade (GS/CT-14 level). Specialized experience is defined as: Experience managing the agency’s policy and implementation to ensure that plans and procedures are in place to ensure recovery and continued operations of the department’s information systems in the event of disruption; Conduct and support routine internal and external security assessments to evaluate the strength and effectiveness of the agency’s Cybersecurity program; and Effectively communicate and resolve a crisis or urgent matter within the pertinent domain to mitigate immediate and potential threats through preparedness, investigation, and the use of response and recovery as appropriate to maximize information security.

(NOTE: Your resume must CLEARLY demonstrate this experience.) AND Basic Requirement: In addition to the Specialized Experience above, you must meet the basic requirements for the Information Technology (IT) Management Series 2210 as described below. A. You must have Information Technology related experience demonstrating each of the following required competencies.

Please refer to the Qualifications Standard: Competency-Based Qualification Standard for the Information Technology Management Series, 2210 Leadership

• Influences motivates, and challenges others; adapts leadership styles to a variety of situations . Developing Others
• Develops the ability of others to perform and contribute to the organization by providing ongoing feedback and by providing opportunities to learn through formal and informal methods. Attention to Detail
• Is thorough when performing work and conscientious about attending to detail. Customer Service
• Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. Decision Making
• Makes sound, well-informed, and objective decisions; perceives the impact and implications of decisions; commits to action, even in uncertain situations, to accomplish organizational goals; causes change. Information Management
• Identifies a need for and knows where or how to gather information; organizes and maintains information or information management systems. Interpersonal Skills
• Shows understanding, friendliness, courtesy, tact, empathy, concern, and politeness to others; develops and maintains effective relationships with others; may include effectively dealing with individuals who are difficult, hostile, or distressed; relates well to people from varied backgrounds and different situations. Oral Communication
• Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. Problem Solving
• Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. Reasoning
• Identifies rules, principles, or relationships that explain facts, data, or other information; analyzes information and make correct inferences or draws accurate conclusions. Teamwork
• Encourages and facilitates cooperation, pride, trust, and group identity; fosters commitment and team spirit; works with others to achieve goals. Technical Competence
• Uses knowledge that is acquired through formal training or on-the-job experience to perform one's job; works with, understands, and evaluates technical information related to the job; advises others on technical issues.

Education

is not required, nor may it be substituted for specialized experience. Please refer to the OPM Qualifications Standard listed in the "Qualifications Section" of this announcement.