Mitigation and Response - Leadership

DHS Headquarters • Chandler, AZ

5d

About The Position

The Department of Homeland Security is recruiting professionals for leadership roles in Mitigation and Response within the DHS Cybersecurity Service. Example roles include Vulnerability Response Section Chief, Lead Cyber Incident Response Coordinator, Targeted Notifications Section Chief, and Senior Cyber Incident Manager. This announcement builds a talent pool: applicants who successfully complete the DHS-CS multi-phase assessment process may be considered for relevant openings for up to one year after completing the process.

Opportunities may support specialized programs at DHS PLCY, CISA, DHS OCIO, FEMA, ICE, and the U.S. Secret Service. Depending on career level and role, employees lead or oversee teams and programs responsible for cybersecurity monitoring, analysis, incident response, vulnerability mitigation, and recovery. Work includes providing situational awareness and strategic communications to DHS leadership, components, and external stakeholders; coordinating security operations; managing SIEM and endpoint security tools; and directing the handling, analysis, preservation, and presentation of digital evidence.

The role also includes responding to prioritized cyber events and indicators of compromise, investigating incidents, analyzing root causes, recommending mitigations, executing and adapting recovery plans, and helping ensure incident handling follows NIST guidance. Cybersecurity Service positions do not require a degree. The roles are in the Leadership Career Track and span multiple career levels.

Requirements

• Be a U.S. citizen or national.
• Be at least 18 years of age.
• If male, be registered for Selective Service.
• Be able to obtain and maintain a security clearance; clearance levels may vary.
• Be able to submit to a drug test and receive a negative result.
• Comply with ethics and standards-of-conduct requirements, including applicable financial disclosure requirements.
• May be required to serve a three-year probationary period.
• Leadership-track employees generally have 5–15 years of cybersecurity work experience and 0–5 years of cybersecurity leadership experience.
• Demonstrate capability in mitigation and response, including responding to urgent cyber events and indicators of compromise, investigating and analyzing incidents, coordinating response, recommending mitigation, and executing and adapting recovery plans.

Responsibilities

• Lead or oversee teams or programs conducting monitoring, analysis, incident response, and incident handling for DHS or its constituents.
• Analyze network traffic patterns and logs from sources such as hosts, networks, firewalls, and intrusion detection systems, using analytic tools and data science methodologies to identify potential threats.
• Lead monitoring of DHS environments for threats and vulnerabilities and provide enterprise situational visibility to DHS or external agency and private-sector leadership.
• Oversee threat assessments of vulnerabilities in networks, software, and hardware, and recommend mitigation measures.
• Ensure incidents are managed in accordance with NIST incident-handling stages and help less-experienced staff apply those standards.
• Tailor communications for different leadership levels and audiences to provide strategic direction and support to DHS, component leadership, security operations centers, and external constituents.
• Collaborate with internal and external DHS stakeholders on security operations and incident handling.
• Work with headquarters or component network and security operations centers to block hostile sites or restrict access by specific ports or protocols.
• Manage processes for implementing, configuring, monitoring, and maintaining SIEM tools on DHS or federal and national partner networks and enclaves.
• Manage techniques for gathering, recovering, analyzing, interpreting, preserving, and presenting digital information and evidence to support legal prosecution or other departmental requirements.
• Incorporate stakeholder feedback into recovery action plans, including interim mitigation strategies for system vulnerabilities and deficiencies.
• Tailor incident updates and after-action reports to emphasize critical information and address anticipated audience concerns.
• Propose, manage, and maintain cybersecurity tools, including SIEM and endpoint security tools.
• Oversee managers, cyber incident responders, and cybersecurity service provider team members handling suspected cyber incidents; communicate event history, status, and potential impact for further action under the organization's incident response plan.
• Collaborate with team members to collect intrusion artifacts, such as source code, malware, and trojans, and use findings to support mitigation under recovery action plans.
• Track and respond to prioritized urgent IT and cyber events and indicators of compromise to mitigate threats to networks, systems, and applications.
• Investigate and analyze response activities and apply advanced response and recovery approaches as appropriate.
• Apply knowledge of investigative processes and adversary tactics, techniques, and procedures, and implement corresponding defenses or security controls.
• Conduct root cause analysis and response coordination, recommending mitigations.
• Execute recovery action plans and adapt them to new developments.

Benefits

• Federal employment benefits are available to support employees' professional and personal lives; specific benefits are provided during the application process.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed