Information Technology Specialist (INFOSEC)

Customs and Border Protection • Ashburn, VA

10d • Onsite

About The Position

This position is with the Department of Homeland Security, U.S. Customs and Border Protection (CBP), Office of Information & Technology, Cyber Security Directorate, Security Operations Division, located in Ashburn, Virginia. It supports the security of CBP information systems, networks, facilities, and communications technologies by planning, implementing, maintaining, and improving cybersecurity programs, policies, procedures, and tools. The goal is to protect the confidentiality, integrity, and availability of data and systems.

The role focuses on cyber threat hunting and intelligence analysis for CBP Mission Essential Systems, High Value Assets, networks, and other critical infrastructure. The employee develops threat indicators, alerts, reports, metrics, and briefings; researches technical and all-source intelligence; investigates adversary behavior; and notifies relevant managers and responders about suspected cyber incidents. The position starts at $143,913 (GS-14, Step 1) and has a stated salary range up to $187,093 (GS-14, Step 10).

Requirements

• Be a U.S. citizen.
• Meet the IT-related experience basic requirement by demonstrating attention to detail, customer service, oral communication, and problem solving.
• Have one year of specialized experience equivalent to at least the next lower grade level.
• Use enterprise cybersecurity tools to identify, contain, and mitigate advanced threats and cyber intrusions.
• Analyze technical evidence across the cyber kill chain and MITRE ATT&CK framework.
• Correlate forensic artifacts, indicators of compromise, and threat intelligence from network and host systems to identify adversary tactics, techniques, and procedures.
• Analyze large volumes of cybersecurity logs from multiple sources to identify hidden malicious activity, lateral movement, and unusual behavior that may bypass traditional security controls.
• Incorporate cyber threat intelligence and attribution information into threat hunting; lead incident-response triage; prepare technical threat reports; and communicate cyber risks and recommended actions to operational teams and senior leadership.
• Explicitly document the required specialized experience in the resume.
• Meet applicable qualification requirements by 10/30/2026.
• Meet the residency requirement of physically residing in the United States or its protectorates for at least three of the last five years, unless eligible for a waiver.
• Undergo a background investigation and applicable pre-employment processes; drug testing may be required under the DHS Drug-Free Workplace Plan.
• Males born after 12/31/1959 must be registered with Selective Service.
• All pre-employment processes are conducted in English.
• New federal employees must serve a one-year probationary period; current or former federal employees may also be required to serve or complete a probationary period.
• May be required to obtain a TS/SCI or higher-level security clearance.
• Disclose qualifying current or recent Executive Branch political-appointee service to the Human Resources Office.

Responsibilities

• Develop and deliver briefings to CBP senior leaders on threat-hunting leads and trends affecting Mission Essential Systems and High Value Assets, and develop metrics on TTPs, IOCs, and IOAs discovered on CBP networks and assets.
• Lead development of alerts, reports, metrics, and briefings on cyber threat indicators and indications, threat intelligence, and attack trends.
• Synthesize intelligence information, place it in context, and draw insights about possible implications.
• Lead research and evaluation of technical and all-source intelligence to develop in-depth threat analyses and assessments concerning systems, critical networks, and critical infrastructure.
• Manage all-source research to determine adversary capability, intent, and prioritization.
• Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents, and communicate the event history, status, and potential impact in accordance with the organization's cyber incident response plan.
• Conduct hypothesis-driven investigations based on threat intelligence and collected attack data to identify attackers' latest TTPs and determine whether those behaviors are present in CBP's environment.

Benefits

• A comprehensive federal employee benefits package is available to the employee and family; specific benefits depend on position type and should be confirmed with the hiring agency.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed