Information Systems Security Officer; ISSO

Position Overview

This position is in the National Institute on Drug Abuse (NIDA), Information and Resource Management Branch (IRMB). The IRMB serves as the central point for Institute-wide Information Technology (IT) resources, policies, and procedures and supports both administrative and scientific applications throughout the full software development lifecycle - initiation and implementation to operations and maintenance.

You qualify for this position at the GS-14 level because you have IT related experience demonstrated by paid or unpaid experience obtained in either the private or public sector, and/or completion of specific, intensive training that demonstrates that you possess each of the following four competencies:

• Attention to Detail – is thorough when performing work and conscientious about attending to detail;
• Customer Service – Works with clients and customers to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services;
• Oral Communication – Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information; makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately;
• Problem Solving – Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations;
• 1 year of specialized experience equivalent to at least the GS-13 level in the Federal service obtained in either the private or public sector typically gained in the IT field or through performing the following types of IT tasks:
  • a) Interpreting and applying privacy laws, regulations, and policies, including Privacy Act requirements, to evaluate compliance, resolve privacy-related issues, and implement corrective actions to protect sensitive information and organizational data.
  • b) Managing cybersecurity incident response and threat mitigation activities by identifying security threats, analyzing security incidents, directing containment and remediation efforts, and implementing corrective actions to reduce organizational risk.
  • c) Conducting Security Assessment and Authorization (SA&A) activities by reviewing security assessment deliverables, evaluating security controls, managing Plans of Action and Milestones (POA&Ms), supporting Federal Information Security Modernization Act (FISMA) compliance efforts, and overseeing Continuous Monitoring activities for authorized information systems.
  • d) Providing information security program guidance to senior leadership and management officials by assessing organizational security posture, evaluating cybersecurity risks, and developing recommendations to support information security program objectives and risk management decisions.
  • e) Managing cybersecurity risk reduction activities by overseeing vulnerability management efforts, monitoring remediation activities, and developing cybersecurity awareness and education initiatives to strengthen workforce security practices and reduce organizational exposure to cyber threats.

You will receive credit for all experience material to the position, including experience gained in religious, civic, welfare, service, and organizational activities, regardless of whether you received pay.