Chief Information Security Officer

Office of Personnel Management•District of Columbia, DC

1d•Onsite

About The Position

The Chief Information Security Officer serves with the U.S. Office of Personnel Management, Office of the Chief Information Officer, directing agency-wide cybersecurity policies, risk management, security engineering, incident response, and supply chain security programs. The role manages resources to protect agency systems and information and advises senior leadership on security risks. The CISO directs cybersecurity policy and governance, oversees risk assessments and compliance, leads the supply chain risk management and embedded security engineering programs, and coordinates agency-wide incident response. The position supervises cybersecurity personnel through subordinate supervisors and team leads, manages program budgets and contracts, and represents the agency in government-wide cybersecurity initiatives. This is a supervisory federal position classified as Supervisory IT Cybersecurity Specialist, GS-2210-15. The incumbent must report to an OPM-assigned office. The position is not eligible for inclusion in a bargaining unit. Relocation expenses will not be paid.

Requirements

Be a U.S. Citizen or National.
Males born after 12-31-59 must be registered for Selective Service.
Be suitable for Federal employment, as determined by a background investigation.
Complete the initial online assessment and USAHire Assessment, if required.
Report to an OPM-assigned office.
Demonstrate specialized experience equivalent to at least the GS-14 level in the Federal service, or equivalent, performing information technology cybersecurity work.
Have experience developing or implementing organizational cybersecurity policies, security standards, and technical controls to protect information systems and data.
Have experience managing cybersecurity governance, risk management, and compliance activities, including evaluating security risks, reviewing security assessments, and recommending risk mitigation actions.
Have experience directing or coordinating cybersecurity engineering activities, including integrating security requirements and controls into information systems, cloud environments, or software development processes.
Have experience leading cybersecurity incident response activities, including coordinating investigations, containment, recovery, reporting, and corrective actions.
Have experience managing cybersecurity programs or organizational functions, including establishing priorities, overseeing personnel or technical teams, and allocating resources to accomplish security objectives.
Meet the required competency levels: Attention to Detail—Level 4; Customer Service—Level 4; Decision Making—Level 3; Information Management—Level 4; Interpersonal Skills—Level 4; Oral Communication—Level 3; Problem Solving—Level 4; Teamwork—Level 4; and Technical Competence—Level 4.
Meet all qualification and eligibility requirements by the announcement closing date.
A one-year probationary period may be required.

Responsibilities

Direct agency-wide cybersecurity policies, data classification standards, and security requirements for information systems, emerging technologies, and secure software development.
Oversee cybersecurity governance, risk assessments, security authorization recommendations, compliance monitoring, vulnerability remediation, and responses to audits and oversight requirements.
Direct the agency's supply chain risk management program, including third-party security risk assessments, acquisition security requirements, and software supply chain protections.
Manage the embedded security engineering program by establishing security review processes, engineering standards, and safeguards throughout the system development lifecycle.
Lead agency-wide cybersecurity incident response, including incident declarations, containment and recovery coordination, required reporting, and corrective action tracking.
Supervise cybersecurity personnel through subordinate supervisors and team leads, including performance management, staffing, employee development, and workforce planning.
Manage cybersecurity program budgets, contracts, and resources.
Advise senior leadership on security risks.
Represent the agency in government-wide cybersecurity initiatives.