Information Technology Specialist (Security)

U.S. Judicial Branch; Washington (District of Columbia); On-site; USD 125,000 - 150,000; Full time

Job summary

An established industry player in the U.S. judicial system is seeking a dedicated cybersecurity professional to lead threat detection and incident coordination efforts. This role involves working within a dynamic 24/7 Security Operations Center, where you will be empowered to manage incident response activities and ensure robust defenses against cyber threats. The ideal candidate will possess a methodical approach, strong analytical skills, and a solid understanding of networking protocols and security infrastructure. If you are passionate about cybersecurity and eager to contribute to the protection of vital information systems, this is an exciting opportunity to make a significant impact.

Qualifications

• 1 year of specialized experience in cybersecurity and incident response.
• Strong analytical skills and attention to detail required.

Responsibilities

• Lead threat detection and incident coordination in a 24/7 Security Operations Center.
• Task and direct incident response activities for cyber operations.

Skills

Threat detection

Incident coordination

Networking protocols (TCP/IP, OSI)

Security infrastructure (firewalls, WAFs)

Operating system security (Windows, Linux, macOS)

Adversarial tactics analysis

Endpoint detection and response (EDR)

Tools

CrowdStrike

Qualys

Job description

This position is located within the Department of Technology Services (DTS), Information Technology Security Office (ITSO). The candidates will be responsible for leading threat detection and incident coordination efforts within ITSO's 24/7 Security Operations Center and are empowered to task and direct all incident response activities in support of defensive cyber operations internal defense measures.

The incumbent is methodical, analytical, has strong attention to detail, and has strong leadership and briefing skills. Technical knowledge and skills are required, but the Judiciary Watch Officer is not necessarily the Subject Matter Expert (SME) for hands-on response but has sufficient technical knowledge to identify and task appropriate SMEs when required. Such expertise requires a broad technical background with emphasis on operational procedures.

Duties include, but are not limited to the following:

Requirements

CONDITIONS OF EMPLOYMENT

Qualifications

Applicants must have demonstrated experience as listed below. This requirement is according to the AO Classification, Compensation, and Recruitment Systems which include interpretive guidance and reference to the OPM Operating Manual for Qualification Standards for General Schedule Positions.

Specialized Experience:

Applicants must have at least one full year (52 weeks) of specialized experience which is in or directly related to the line of work of this position. Specialized experience must demonstrate ALL areas defined below:

• Knowledge of networking protocols to include detailed understanding of Transmission Control Protocol / Internet Protocol (TCP/IP), and the Open Systems Interconnection (OSI) model.
• Experience with security infrastructure components, including firewalls, web application firewalls (WAFs), proxies, DNS, and routing protocols, with a deep understanding of their role in enterprise defense strategies.
• Knowledge of operating system internals and built-in security mechanisms, enabling effective identification and remediation of vulnerabilities across Windows, Linux, and macOS platforms.
• Knowledge of adversarial tactics, techniques, and procedures (TTPs), with the ability to analyze and respond to evolving cybersecurity threats through proactive defensive measures.
• Hands-on experience with endpoint detection and response (EDR) solutions such as CrowdStrike and Qualys, while leveraging them to identify, contain, and remediate security incidents.

Desired, but Not Required:

• Certified Information Systems Security Professional (CISSP)
• GIAC Certified Incident Handler (GCIH)
• GIAC Security Operations Certified (GSOC)
• GIAC Cloud Incident Response (GCIR)