Cybersecurity Defensive Operations - Technical

Cybersecurity and Infrastructure Security Agency • Chandler, AZ

1d • $106,700 - $214,500

About The Position

The Department of Homeland Security is recruiting professionals for technical roles in Cybersecurity Defensive Operations, including Intelligence Collection & Analysis (ICA) and Planning, Execution & Analysis (PEA). Potential roles include NOSC Cloud SME, NOSC Cyber SME, CFMA SME, Senior Analytic Tradecraft Advisor, and Incident Manager. Positions support specialized programs across DHS components, including PLCY, CISA, OCIO, FEMA, ICE, and the U.S. Secret Service.

This announcement creates a talent pool for ongoing consideration for relevant openings. Applicants must complete the DHS Cybersecurity Service multi-phase assessment process to qualify for the pool. Qualified applicants may remain eligible for consideration for up to one year after completing that process.

In the Technical Career Track, employees maintain and share cybersecurity defensive operations expertise while carrying out critical, complex, routine, and non-routine work. The role may involve planning and executing cyber operations, collecting and analyzing intelligence, investigating threats and malware, supporting incident response and remediation, producing intelligence products, and mentoring DHS personnel. Career level and salary are matched to an employee’s experience and expertise; DHS may hire at different career levels for this opportunity.

Requirements

• Must be a U.S. citizen or national.
• Must be at least 18 years of age.
• Must be registered for Selective Service if male.
• Must be able to obtain and maintain a security clearance; clearance levels may vary.
• Must submit to a drug test and receive a negative result.
• Must comply with ethics and standards-of-conduct requirements, including applicable financial disclosure requirements.
• May be required to serve a three-year probationary period.
• Technical-track positions generally require 5–15 years of cybersecurity work experience.
• Technical capability in Cybersecurity Defensive Operations generally includes integrating, managing, and executing aspects of the cyberattack lifecycle to inform cyber defense operations; planning and executing defense operations; facilitating the flow and assessment of intelligence data; determining security monitoring and incoming intelligence feeds; and overseeing remediation and containment.

Responsibilities

• Create and implement tactical and strategic cyber operations plans based on technical cybersecurity knowledge, applicable policies, and rules of engagement.
• Support the development of primary and contingency action plans, selecting appropriate defensive or offensive methods aligned with operational protocols.
• Use best practices and available capabilities to conduct defensive or offensive cyber operations against identified threats to DHS networks and systems.
• Apply knowledge of national strategies, plans, policies, and directives for offensive and defensive cyber operations.
• Examine indicators of compromise and integrate digital forensics and incident response data to strengthen DHS and partner defenses.
• Engage with network defenders and intelligence components to understand intrusion sets and deviations and develop defensive cybersecurity strategies.
• Conduct reverse malware analysis and apply engineering techniques to prevent incidents or mitigate threats to federal systems and networks.
• Collect and disseminate information on cyber threats and threat actors using intelligence collection tools and methods.
• Identify customer information needs and formulate executable collection plans and strategies.
• Analyze all-source intelligence on current and emerging cyber threats, evaluating cyber actors’ intent and capabilities using intelligence community analytic standards.
• Provide cyber intelligence and analysis to inform cyber operations and support the intelligence cycle by evaluating information and identifying customer needs.
• Prepare and refine intelligence products, including written reports and briefings, for senior officials, decision makers, planners, network defenders, and other audiences.
• Mentor DHS employees in cyber defensive operations and those developing expertise in the field.
• Plan and execute cybersecurity defense operations to protect assets, facilitate intelligence assessment, determine monitoring and intelligence-feed needs, and oversee remediation and containment processes.

Benefits

• Federal employment benefits are available to DHS Cybersecurity Service employees; specific benefits depend on the position and will be provided during the application process.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed