IT Specialist (Security)

US Deputy Assistant Secretary for Information and Technology; Hines (IL); On-site; USD 90,000 - 120,000; Full time

Job summary

The IT Specialist (Security) is based in the VA Office of Information Security, CSOC, within OI&T. The position requires specialized experience at the GS-13 level, with focus on network traffic analysis, event correlation, and threat hunting using SIEM and EDR tools.

The successful candidate will apply the MITRE ATT&CK framework to identify and mitigate threats, provide risk-based recommendations, and work with contract staff in a non-supervisory capacity. Occasional travel is required.

Qualifications

• One year of specialized experience equivalent to GS-13 in the federal service.
• Experience characterizing and analyzing network traffic to identify anomalous activity and threats.
• Experience applying a structured adversary behavior framework (e.g., MITRE ATT&CK) to identify TTPs and IOCs.

Skills

Attention to Detail

Customer Service

Oral Communication

Problem Solving

Tools

SIEM

EDR

Event Correlation

Job description

This IT Specialist (Security) position is located in the Office and Information and Technology (OI&T), Office of Information Security (OIS), Information Security Office (ISO), Cyber Security Operations Center (CSOC). The Office of Information and Technology (OI&T) provides adaptable, secure, and cost- effective technology services across the Department of Veterans Affairs (VA). To qualify for this position, applicants must meet all requirements by the closing date of this announcement, 10/07/2026.

Applicants must have IT-related experience demonstrating each of the four competencies listed below at a proficiency level equivalent to the next lower grade level in federal service.

You must meet both the Basic Requirement and the Specialized Experience and the Selective Placement Factor to qualify for this series as described below

1. Attention to Detail - Is thorough when performing work and conscientious about attending to detail.
2. Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services.
3. Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately.
4. Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations.

AND

• Specialized Experience: You must have one year of specialized experience equivalent to at least the next lower grade GS-13 in the normal line of progression for the occupation in the organization. Experience characterizing and analyzing network traffic to identify anomalous activity and potential threats to network resources; performing event correlation using information gathered from a variety of enterprise sources to determine the effectiveness of an observed attack; analyzing malicious activity to determine weaknesses exploited, exploitation methods, and effects on systems and information; and providing risk mitigation recommendations based on Federal laws, regulations, and organizational policies.

Selective Placement Factor: D

eveloping, tuning, and validating detection analytics and correlation rules within Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to support proactive threat hunting and cybersecurity incident response operations, to include applying a structured adversary behavior framework (e.g., MITRE ATT&CK) to identify tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) not detected through automated alerting; and experience providing technical direction and quality review of work performed by contract staff supporting these functions, in a non-supervisory capacity.

Physical Demands

The work is primarily sedentary during the planning/preparation phase. The work may require walking and standing for prolong periods in conjunction with travel and at the onsite assessment location. The incumbent may carry light items such as papers, books or computers, or drive a motor vehicle. The work does not require any special physical effort.

Work Environment

The work area is adequately lighted, heated, and ventilated. The work environment involves everyday risks or discomforts that require normal safety precautions. The responsibilities of the position require frequent travel and may subject the incumbent to various resultant environmental changes; incumbent must be amenable to such period of travel and to working in unfamiliar surroundings. This position requires occasional travel using both air and ground transportation. For more information on these qualification standards, please visit the United States Office of Personnel Management's website at https://www.opm.gov/policy-data-oversight/classification-qualifications/general-schedule-qualification-standards/.