Chief Information Security Officer (CISO), EM-2210-00 (Merit Promotion)

Summary

This position is located in the Chief Information Officer Organization (CIOO), Office of the Chief Information Security Officer (OCISO) of the Federal Deposit Insurance Corporation and provides support in Washington, D.C. Salary reflects a pay cap for this position of $315,000.

Duties

• As the Chief Information Security Officer (CISO) and Director of the Office of the Chief Information Security Officer, the incumbent provides the necessary technical expertise and leadership required to assure FDIC information and manage risks related to the use, processing, storage, and transmission of information, including the protection of the integrity, availability, authenticity, non-repudiation, and confidentiality of user data. Working with FDIC executives and senior leadership and under the direction of the CIO, the CISO establishes an agency-wide information security vision and strategy, including the creation and maintenance of FDIC's information security and privacy policy, risk assessment, compliance, oversight, and ensuring continuity of operations. Program responsibilities include information security architecture and engineering; activities to identify, protect, detect, respond, and recover from cybersecurity threats; assessments and authorizations; information security and privacy risk management; and information security/privacy awareness and training. Additionally, the incumbent is responsible for management and oversight of the FDIC's privacy program and demonstrating compliance with all relevant federal laws and regulations. Provides executive leadership, management and oversight for effective strategic planning and budget control, workforce planning, policy and standards development, resource management, knowledge management, information security architecture, engineering, and infrastructure planning, auditing, and information security management. Represents the FDIC at executive-level meetings with federal organizations such as OMB, the Government Accountability Office (GAO), and other federal government agencies (Departments), other FIRREA organizations, as well as non-profit and private sector companies and organizations. Proactively works with business units to implement practices that meet defined policies and standards for information security and will also oversee a variety of risk management activities. Maintains ongoing knowledge of: (a) Federal legislation, regulation, policies, and practices related to cybersecurity, privacy and information systems security; (b) methodologies and best practices that are commonly used in the information systems security industry; (c) the status of Federal Information Systems Security initiatives that offer opportunities for or pose requirements to be met by the FDIC; (d) the review of IT architectures used at all FDIC locations including microcomputer, server, mainframe processing levels and related peripheral products to assess and remediate weaknesses to information systems security; (e) Cloud or COTS software packages; custom developed software applications; Code libraries, and network and telecommunications products and technologies; and (f) threats and vulnerabilities that could impact FDIC value assets and information. Directs Corporation-wide information security and privacy programs that comply with federally mandated requirements and commonly accepted industry best practices. Oversees vulnerability assessments and supports audits as appropriate to: (a) ascertain the current state of information system security and to highlight areas of high, medium and low risk to agency management; (b) identify systems that process or store personally identifiable information (PII) or sensitive business information, and advise and support the identification and remediation of their associated risks, lead the assessment and authorization process to ensure systems are implemented with the appropriate security/privacy controls prior to being released into production. Proactively works with managers overseeing system architecture, proactively advising and monitoring to promote compliance with Federal and industry requirements, and to minimize the risk of disruption to operations through the necessary controls to maintain the confidentiality, integrity, and availability needs of information and systems. Exercises supervisory personnel management authority directly or indirectly through subordinate senior managers to include: planning, assigning, and reviewing work products of subordinates; establishing guidelines and performance expectations; and evaluating work performance and providing feedback. Identifies training and developmental needs for staff and provides regular recognition of staff. Works in collaboration with the appropriate Human Resources and Legal staff to administer disciplinary action. Hears and resolves grievances or other disputes as appropriate. Approves/disapproves requests for leave, telework, travel, training, etc. Ensures that programs are administered effectively and in accordance with broadly stated objectives and priorities.

Qualifications

To meet the minimum qualifications, applicants must possess the leadership and technical experiences listed below. These qualifications would typically be gained through progressively responsible management or executive-level assignments. Qualifying experience may be obtained in the private or public sector. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic, religious/spiritual; community; student, social). Volunteer work helps build critical competencies, knowledge, skills, and abilities and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. MINIMUM QUALIFICATIONS: All applicants must submit a resume that addresses each minimum qualification experience. Examples should be clear, concise, and emphasize your level of responsibilities; the scope and complexity of the programs, activities, or services you managed; program accomplishments; policy initiatives undertook; level of contacts; the sensitivity and criticality of the issues you addressed; and the results of your actions. You should use action-oriented leadership words to describe your experience and accomplishments and quantify your experience wherever possible to demonstrate your accomplishments (e.g., number of employees supervised). Leadership experiences identified must have been performed in an official supervisory role. Leadership Experience 1: Experience in overseeing and coordinating the work of organizational units directly and indirectly through subordinate supervisors, including assigning work, directing changes to programs and priorities, and evaluating performance against goals; AND Leadership Experience 2: Experience in managing employee performance and growth directly and indirectly through subordinate supervisors, including evaluating employee readiness for successive roles, recognizing accomplishments, providing feedback and development opportunities, and addressing performance/conduct issues; AND Leadership Experience 3: Experience in overseeing implementation of and improvements to recruiting, hiring, training, utilization, and succession readiness of staff; AND Technical Experience 1: Experience in directing information security and/or privacy programs impacting large organizations; AND Technical Experience 2: Experience in translating business requirements into business solutions with information technology to include the development, implementation and maintenance of cybersecurity and privacy programs responsive to the organization's mission.

Education

There is no substitution of education for the experience for this position.

Requirements

2-page Resume Requirement: Please limit your résumé to 2 pages (minimum 10-point font). If more than 2 pages are submitted, only the first 2 pages will be reviewed to determine your eligibility/qualifications. Registration with the Selective Service. U.S. Citizenship is required. Employment Conditions. Completion of Confidential Financial Disclosure may be required. Top Secret with Sensitive Compartmented Information (SCI) required. Ability to obtain and maintain a Top-Secret security clearance. Applicant tentatively selected for this position will be required to submit to urinalysis to screen for illegal drug use prior to appointment and will be subject to random drug tests. Must be able to obtain and maintain an interim and/or final security clearance prior to entrance on duty. Failure to obtain and maintain the required level of security clearance may result in the withdrawal of a job offer or removal. Employee may be relocated to any duty location to meet management needs.

Evaluations

Your resume will be reviewed, to determine whether you meet the qualification requirements outlined in this announcement. Therefore, it is imperative that your resume contains sufficiently detailed information upon which to make the qualification determination. If you are found minimally qualified, a Management Rating Panel (MRP) will review your qualifications and experience against pre-established benchmarks. The rating panel will place applications in one of three quality categories, i.e., Best Qualified, Highly Qualified, or Qualified. These category assignments are a measure of the degree in which your background and responses to the assessment questions match the competencies listed below. Top ranked (Best Qualified) candidates will be referred to the selecting official for further review and consideration. The competencies/KSAs you will be assessed on are listed below. Strategic Thinking Managing Risk Organizational Awareness Interpersonal Relationships External Awareness Financial and Resource Management Change Management Organizational Stewardship Knowledge of and ability to work with emerging and/or state-of-the-art information security techniques, technologies and tools whether commercially available, Government supplied, or custom developed (e.g., maintaining information security/privacy, monitoring, assessing and evaluating security; security forensics work). Knowledge and experience in developing information security and privacy programs, policies and procedures, as well as successfully executing these to meet organization objectives and drive excellence in a dynamic environment. Knowledge of legacy and modern IT infrastructures, principles, architecture, and associated risk analysis methods and techniques to evaluate, develop and implement security strategies that align with business goals. You do not need to respond separately to these competencies/KSAs. Your resume will serve as responses to the competencies/KSAs. Applicants must provide details of the duties performed as they relate to the qualifying experience and competencies/KSAs. Experience must be explicitly stated in the resume as experience not specifically described in the resume cannot be assumed. Resumes that are vague or don't address specific requirements will not receive maximum consideration. You may preview questions for this vacancy.

How to apply

To begin, click the “Apply” button and follow the prompts. If you haven't already, register and establish a USAJOBS account. After you register online, click the “Apply” button to complete the online assessment questionnaire, and submit all required documents. Please be sure to click “Submit Application” to complete the application process. You must apply online. To apply for this position, you MUST provide a complete application package. Applicants requesting an exception from the online process must contact the Human Resources Specialist or point of contact listed in this announcement prior to 12:00 noon local time on the closing date. To return to your saved application, log in to your USAJOBS account and click on “Applications” tab. Click on the “Position Title,” and then select “Update Application” or “Additional Application Information” to continue. You have until 11:59 p.m. ET (Eastern Time) on the closing date of this announcement to complete the application process. Please ensure you have completed the application process by verifying the status of your application on-line to reflect: “Received”. Failure to complete the application process will result in an incomplete application and you will not be considered for the position. To begin, click the “Apply” button and follow the prompts. If you haven't already, register and establish a USAJOBS account. After you register online, click the “Apply” button to complete the online assessment questionnaire, and submit all required documents. Please be sure to click “Submit Application” to complete the application process. You must apply online. To apply for this position, you MUST provide a complete application package. Applicants requesting an exception from the online process must contact the Human Resources Specialist or point of contact listed in this announcement prior to 12:00 noon local time on the closing date. To return to your saved application, log in to your USAJOBS account and click on “Applications” tab. Click on the “Position Title,” and then select “Update Application” or “Additional Application Information” to continue. You have until 11:59 p.m. ET (Eastern Time) on the closing date of this announcement to complete the application process. Please ensure you have completed the application process by verifying the status of your application on-line to reflect: “Received”. Failure to complete the application process will result in an incomplete application and you will not be considered for the position.

What to expect next

You may check the status of your application on-line 24 hours a day, 7 days a week through USAJOBS by signing in and selecting "Application Status." Thank you for your interest in working for the Federal Deposit Insurance Corporation. The Fair Chance Act prohibits inquiries concerning an applicant's criminal history information unless the hiring agency has made a conditional (tentative) offer of employment to the applicant. An applicant may submit a complaint, or any other information, to the agency within 30 calendar days of the date of alleged non-compliance by contacting the Federal Deposit Insurance Corporation's Human Resources Staffing Policy and Accountability team at [email protected] For more information go to FDIC Fair Chance to Compete for Jobs Act.

Required documents

If you are applying under any special hiring authority you MUST submit proof of eligibility with your application. Failure to provide all of the required documentation as stated in this vacancy announcement may result in an ineligible determination or may affect your consideration status. Please review the following to determine your eligibility and which document(s) is required to complete your application: Your two (2) page resume showing all relevant work experience (paid and unpaid) including: duties performed; full name and address of each employer; start and end dates (month/year); work schedule (part-time, full-time, number of hours if intermittent); salary; and any completed education and training (program title, subject area, number of hours completed, and completion date). VETERANS EMPLOYMENT OPPORTUNITY ACT (VEOA) ELIGIBLES AND SPECIAL HIRING AUTHORITIES FOR VETERANS: If you are applying for consideration under VEOA and special hiring authorities for veterans, click here. You must submit documentation (e.g., DD-214, VA Letter, SF-15, etc.) to demonstrate veterans' eligibility. SPECIAL APPOINTING AUTHORITIES FOR PEOPLE WITH DISABILITIES: If you are applying for consideration under special appointing authorities for people with disabilities, you will be required to provide proof of disability documentation to specify that you are a person who (1) has a severe physical disability; (2) an intellectual disability; or (3) a psychiatric disability. The documentation does NOT need to detail your specific disability, medical history, or need for accommodation, however; the letter MUST clearly state that you are eligible for appointment under this authority and that your eligibility is based on a severe physical disability; an intellectual disability; or a psychiatric disability. THE DOCUMENTATION MUST HAVE BEEN OBTAINED FROM: (a). Licensed medical professionals; or (b). State or private vocational rehabilitation specialists; or (c). Any Government agency (e.g., VA, etc.) that issues or provides disability benefits. THE DOCUMENTATION MUST INCLUDE: a statement that you are eligible based on one of the following: severe physical disability, an intellectual disability, or a psychiatric disability. To view sample Schedule A proof of disability letters, click here, and for more information on this special appointing authority, click here. Please note that employees hired under this Schedule A hiring authority will be required to complete a Standard Form 256 to identify their disability status. CURRENT FEDERAL EMPLOYEES OR REINSTATEMENT ELIGIBLES WITH COMPETITIVE STATUS: A copy of your most recent SF Form 50, Notification of Personnel Action that shows: (1) permanent or career-conditional tenure (codes 1 or 2, in block 24), and (2) position occupied in the competitive service (code 1, in block 34). If reinstatement eligible, include your Career/Career conditional SF-50. To be considered as a non-competitive eligible candidate, the SF-50 must show the highest grade level or full performance level applicant has attained competitively on a permanent basis, and grade must be equivalent or higher than the grade for which applying. EXCEPTED SERVICE EMPLOYEES: Your current agency must have an interchange agreement with OPM (for a list of agencies with current interchange agreements please click here); Excepted service appointees without an interchange agreement are eligible to use any other applicable special appointing authorities or must apply under the public non-status announcement for consideration. CURRENT OR FORMER CAREER SES MEMBERS: You are eligible for reinstatement to a competitive service position if you were previously employed under a career or career-conditional appointment prior to the SES appointment. SES members without competitive service career status are eligible to use any other applicable special appointing authorities or must apply under the public non-status announcement for consideration. Multiple SF-50s showing current or former career SES appointment and proof of career or career-conditional tenure must be submitted by the closing date to receive consideration as a status applicant. Both SES and Competitive Service SF-50s must be uploaded as one document to avoid overriding your first attachment or upload one SF-50 under the “SF-50” placeholder and the other under the “other supporting documentation” placeholder. If you have any questions regarding which SF-50s to submit or how to upload them, it is highly recommended that you contact the person listed on this job opportunity announcement before the closing date. FDIC EMPLOYEES: If you want to be considered non-competitively include a copy of your SF-50. The SF-50 must show the highest grade level or full performance level applicant has attained competitively on a permanent basis, and grade must be equivalent or higher than the grade for which applying.

Benefits

The FDIC offers comprehensive benefits to its employees. These benefits, some at minimal cost, are some of the best and most competitive in both the private and public sectors. In addition, under FDIC's Group Life Insurance Program, basic life insurance coverage for Executive Managers is automatically equal to 3 times their salary (rounded to the next higher thousand) up to a maximum of $800,000. Executives may also choose from two other lower coverage options. The Corporation pays for the cost of the basic coverage unless employees also elect to be covered under the Federal Employees Group Life Insurance Program (FEGLI). To find out more, click here.

Other information

If selected, you may be required to serve a probationary or trial period as applicable to appointment type. During the probationary or trial period, you will be evaluated for fitness and whether your continued employment advances the public interest. In determining if your employment advances the public interest, we may consider: your performance and conduct; the needs and interests of the agency; whether your continued employment would advance organizational goals of the agency or the Government; and whether your continued employment would advance the efficiency of the Federal service. Upon completion of your probationary or trial period your employment will be terminated unless you receive certification, in writing, that your continued employment advances the public interest. To read about your rights and responsibilities as an applicant for Federal employment, click here. If selected, you may be required to serve a supervisory/managerial probationary period. Additional selections may be made from this vacancy announcement to fill identical vacancies that occur subsequent to this announcement. FDIC Executive Managers (EM) are in the Federal competitive service and not the Senior Executive Service (SES). As an EM at the FDIC, you will provide executive leadership and managerial direction over substantive activities related to planning, developing, executing, and coordinating the Corporation's programs and policies. Current or Former Political Appointees: The Office of Personnel Management (OPM) must authorize employment offers made to current or former political appointees. If you are currently, or have been within the last 5 years, a political Schedule A, Schedule C or Non-Career SES employee in the Executive Branch, you must disclose this information to the HR Office.