IT Cybersecurity Specialist

The U.S. Department of Energy Headquarters is seeking an IT Cybersecurity Specialist (CYBERMGT) to provide independent IT cybersecurity program management guidance, management services, advice, and recommendations to DOE leadership, other Federal agencies, and DOE stakeholders within CESER. This onsite role in Washington, DC focuses on helping drive cybersecurity strategy, risk management, and technical execution across enterprise networks and mission systems.

• Location: Washington, DC (onsite)
• Salary: USD 169,279 to 197,200 per year
• Minimum experience: 1 year
• Security clearance: Top Secret (required)
• Position type: Testing Designated Position (TDP)
• Series/Authority: 2210 series; announced under a government-wide Direct-Hire Authority (DHA) for IT Cybersecurity Specialist (CYBERMGT) positions

What you will do

• Direct the planning, implementation, and long-term sustainment of Department-wide cybersecurity programs, projects, and strategic initiatives to safeguard enterprise networks and mission systems.
• Act as an authoritative technical expert and consultant to senior DOE executives, interagency working groups, and external partners on cybersecurity policies, emerging technologies, and risk management.
• Interpret and implement federal and commercial cybersecurity directives (including NIST, CISA, and OMB) to evaluate compliance, mitigate cyber risk, and address complex IT security issues.
• Oversee design, installation, configuration, testing, and administration of dedicated cyber defense hardware, software, and tools to support resilience and operational performance.
• Lead vulnerability scans, security assessments, and audit reviews to identify deviations from established baselines and recommend remediation strategies across enterprise platforms.
• Justify program requirements, develop resource and staffing plans, and determine technical training needs to align cyber capabilities with mission objectives and protect classified information.

Required technical areas and tools

• NIST
• CISA
• OMB
• NIST SP 800-53 / RMF
• ISO 27001
• CMMC
• Agile

Specialized experience requirements

A qualified candidate’s online application and resume must demonstrate at least one year of specialized experience equivalent to the next lower grade level GS-14. Specialized experience is defined as meeting 2 of 4 criteria:

• Lead and manage cybersecurity or IT security projects from planning through execution, including developing project schedules, tracking milestones, allocating technical resources, and evaluating performance using structured project management or Agile frameworks.
• Direct or oversee the design, implementation, and optimization of enterprise cyber defense tools, hardware, and software to protect complex network infrastructures and sensitive data systems.
• Lead technical vulnerability assessments, system scans, and cyber risk analyses across enterprise systems to identify security weaknesses and engineer remediation or mitigation strategies.
• Evaluate IT systems against formal cybersecurity standards and security control frameworks, including mandates such as NIST SP 800-53/RMF, ISO 27001, CMMC, or equivalent standards, to maintain system authorizations, approve security plans, and remediate compliance deficiencies.

Qualifications and eligibility

• Applicants must have IT-related education and experience demonstrating each of four competencies at a proficiency level equivalent to the next lower grade level in federal service.
• You must be a U.S. Citizen or National.
• If you are a male applicant born after December 31, 1959, you must certify registration with the Selective Service System or an exemption under the Selective Service Law.
• Appointment may be subject to suitability or fitness determination based on a completed background investigation.
• Selected candidates may be required to complete a one-year probationary period.
• This position requires a Financial Disclosure Statement (OGE-450) within 30 days of entering the position and annually thereafter.

Evaluation and assessment

• Your application will be assessed based on how well you meet the listed qualifications.
• USA Hire assessment is used, including an online assessment that measures critical general competencies. You must meet or exceed the cut score to be considered.
• Qualifications are evaluated based on application materials (including resume and supporting documents), questionnaire responses, assessment results, and a minimum qualification review.

Competencies used for successful performance

• Accountability; Attention to Detail; Compliance; Customer Service; Decision Making; Flexibility; Influencing/Negotiating; Information Management; Information Systems Security Certification; Information Systems/Network Security; Integrity/Honesty; Interpersonal Skills; Learning; Project Management; Reading Comprehension; Reasoning; Risk Management; Self-Management; Stress Tolerance

Required documents

• Resume showing all relevant work experience (paid and unpaid), including duties performed, employer name and address, start and end dates (month/day/year), work schedule and hours if intermittent, salary, and completed education and training details (program title, subject area, number of hours, completion date).
• Cover letter (optional), providing additional information not covered in the resume.
• Transcripts, if specific educational requirements are indicated.
• If applicable, CTAP/ICTAP proof of eligibility (RIF notice, separation SF-50, or other official documentation).
• If applicable, CTAP/ICTAP proof of performance rating showing final rating at least “Fully Successful” or equivalent, including rating scale/guide when not clearly defined on the document.

The employer participates in the e-Verify program. A preliminary background check must be completed before a new employee can begin work. Hiring incentives may be authorized for a highly qualified candidate based on budget availability and in accordance with federal regulations. This position is not included in a Bargaining Unit. Required attachments must not include photos, a Social Security Number, or a date of birth.