Supervisory IT Cybersecurity Specialist (INFOSEC)

Deputy Assistant Secretary for Information and Technology • Washington, DC

6d • Onsite

About The Position

The Supervisory IT Cybersecurity Specialist works in the Office of Information Security (OIS) service line under the Office of Information and Technology (OIT), supporting VA’s digital transformation. OIS manages the VA cybersecurity program and delivers enterprise-wide strategy, policy, governance, and network defense to protect Veteran data and VA information systems. The position enhances the security and resilience of VA IT systems and data and helps protect the privacy and trust of Veterans and their families.

The position supervises all areas and tasks within its assigned directorate and directly supervises teams involved in the formal CPCR audit and inspection process, including remediation of draft and final reports. It monitors employee performance, advises on complex IT issues, influences agency IT policies and programs, and ensures rigorous application of information security and assurance policies and practices. The role develops methods to monitor and measure risk, compliance, and assurance efforts and serves as a senior expert and consultant to top agency management on integrating IT programs with other programs of comparable scope and complexity.

The position is primarily aligned with NICE Cybersecurity Workforce Framework work roles 805 (IT Program Auditor), 612 (Security Control Assessor), and 422 (Data Analyst). It is not virtual or remote. The schedule is Monday through Friday, 8:00 a.m. to 4:30 p.m.; compressed or flexible scheduling is determined by agency policy. Occasional travel may be required. The work is primarily sedentary, with occasional walking and standing for travel or meetings, and may take place in computer, power and generator, or telecommunications rooms. The position requires a financial disclosure report and has a one-year probationary period.

Requirements

• U.S. citizenship is required.
• Meet the four IT-related competencies: attention to detail, customer service, oral communication, and problem solving.
• At least one year of specialized experience equivalent to at least the next lower grade in the normal line of progression.
• Specialized experience includes supervising or leading IT specialists and/or program analysts evaluating organizational compliance with information security or risk management policies and standards.
• Experience developing, interpreting, or recommending changes to enterprise- or agency-wide information security or assurance policies, procedures, or risk management frameworks, such as the NIST Risk Management Framework.
• Experience conducting or overseeing IT security audits, assessments, or reviews to identify vulnerabilities, determine compliance with published standards, and recommend mitigation strategies.
• Experience preparing and presenting findings, recommendations, or briefings to senior management on complex or controversial IT security or risk issues.
• Selective Placement Factor: Experience defining and applying enterprise architecture and risk management principles and theories, including purpose (duty to protect), mission need (risk assessment), and controls (design controls to protect), aligned with the NIST RMF throughout the PPBE cycle.
• Selective Placement Factor: Experience holistically evaluating internal and external perspectives; assessing threats and vulnerabilities; determining deviations from acceptable configurations and enterprise or local policy; assessing risk; and developing or recommending mitigation countermeasures in operational and nonoperational situations.
• Complete required application steps and submit all required documents by the announcement closing date of 10/19/2026.
• Selected applicants are subject to a background and suitability investigation and must complete the online onboarding process.
• A one-year probationary period is required.
• Selective Service registration is required for males born after 12/31/1959.

Responsibilities

• Supervise all areas and tasks within the assigned directorate.
• Directly supervise teams conducting the formal CPCR audit and inspection process and oversee remediation of draft and final reports.
• Monitor the performance of employees assigned to the team.
• Provide advice and guidance on complex information technology issues.
• Make decisions or recommendations that significantly influence important agency IT policies or programs.
• Ensure rigorous application of information security and information assurance policies, principles, and practices.
• Develop methods to monitor and measure risk, compliance, and assurance efforts.
• Advise top agency management officials on integrating IT programs with other programs of equivalent scope and complexity.
• Conduct or oversee evaluations of technology programs or components for compliance with published standards.
• Conduct or oversee comprehensive assessments of management, operational, and technical security controls and enhancements to determine effectiveness.
• Analyze data from multiple sources to provide cybersecurity and privacy insight, including designing and implementing algorithms, workflows, and layouts for complex enterprise-scale data sets.

Benefits

• Federal employee benefits package; eligibility depends on position type and employment status.
• VA may offer newly appointed federal employees service credit for qualifying job-related non-federal experience or active-duty uniformed military service for annual leave accrual, subject to request and approval.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed