Information Technology Specialist (Security)

Internal Revenue Service; Washington (District of Columbia); On-site; USD 80,000 - 120,000; Full time

Job summary

The Internal Revenue Service seeks an IT security expert to join the Department of Technology Services. The role involves responding to incidents, understanding adversarial techniques, and analyzing security breaches. Ideal candidates will have robust experience in software development and digital forensics, contributing to critical security operations in a federal environment.

Benefits

Comprehensive benefits package

Access to federal benefits

Qualifications

• 1 year of specialized experience in IT security.
• Proficiency in .NET, PowerShell, C#, or Python.
• Experience with enterprise audit logs and forensic methodologies.

Responsibilities

• Perform incident response under the direction of the Chief, Incident Response Branch.
• Analyze adversarial techniques and intrusion stages.
• Examine and interpret audit logs in Windows and Linux.

Skills

.NET

PowerShell

C#

Python

Digital Forensics

Job description

This position is located within the Department of Technology Services (DTS), Information Technology Security Office (ITSO). The incumbent is a recognized IT security expert with a strong defensive cyber background and "hands-on" experience in incident response. The incumbent will perform multiple and varying assignments under the direction of the Chief, Incident Response Branch - Security Operations Division.

A career with the U.S. government provides employees with a comprehensive benefits package. As a federal employee, you and your family will have access to a range of benefits that are designed to make your federal career very rewarding. Learn more about federal benefits.

Review our benefits

Eligibility for benefits depends on the type of position you hold and whether your position is full-time, part-time or intermittent. Contact the hiring agency for more information on the specific benefits offered.

Applicants must have demonstrated experience as listed below. This requirement is according to the AO Classification, Compensation, and Recruitment Systems which include interpretive guidance and reference to the OPM Operating Manual for Qualification Standards for General Schedule Positions.

Applicants must have at least one full year (52 weeks) of specialized experience, which is in or directly related to the line of work of this position. Specialized experience is demonstrated experience in ALL of the following:

• Development experience to include proficiency in 1 or more of the following: .NET, PowerShell, C# or Python.
• Comprehensive understanding of adversarial techniques, with the capability to technically diagram and articulate the stages of an intrusion.
• SME-level experience examining enterprise audit logs including Windows Event Log and Sysmon in Windows environments, and auditd in Linux environments.
• Knowledge of forensic methodologies and the processes involved in collecting, preserving, and analyzing digital evidence to accurately reconstruct events and support incident response efforts.
• Experience in analyzing sophisticated attacker techniques that exploit email and cloud services as attack vectors.

Desired, but Not Required:

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Cloud Incident Response (GCIR)
• Certified Information Systems Security Professional (CISSP)