Supervisory IT Cybersecurity Specialist (Direct Hire)

This position is in the Division of Administration (DA) in the Information Technology (IT) Branch, Cybersecurity Section. This position serves as the Chief Information Security Officer (CISO) reporting to the Chief Information Officer (CIO).

As the CISO, the incumbent is responsible for managing and overseeing the Commission's Cybersecurity compliance and operations units' activities to ensure compliance with best practices and keep pace with emergent cybersecurity threats. Duties may include: Manage strategic planning and roadmap for the entire cybersecurity program to include strategic/contingency plans for Cyber Incidents of all likely scales and types and perform reviews and testing updates per CIO direction. Plans and oversees formal assessments of Information Systems, mitigate risk through managing the Assessment and Authorization (A&A) process for assuring that existing and new IT systems meet organization's cybersecurity and risk requirements. Oversee the preparation of Authority to Operate (ATO) packages for Authorizing Official's signature. Ensure CISO programs and initiatives are strategically aligned and communicated throughout the Commission through evaluation of adequacy for the Commission's IT security controls and systems. Conduct and support routine internal and external security assessments, tabletop exercises, penetration tests, and playbook development to proactively test the effectiveness of the CFTC's IT Cybersecurity Program. Responsible for CFTC's Cybersecurity Program annual budget report to Congress in highlighting the Commission's progress for meeting mission goals and protecting the agency's information and IT systems. Establishes a comprehensive and effective IT Cybersecurity Program in compliance with Federal laws and regulations by implementing, and managing IT policies, guidelines, standards, processes and management controls, a Mitigates risk through managing the assessment and authorization process for assuring existing and new IT systems meet organization's cybersecurity and risk requirements. Conducts independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an IT system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37). In case of a cybersecurity incident, the response leads by following established crisis management and plans and communicating laterally and vertically as required. Uses mitigation, preparedness, and response and recovery approaches, as needed, to optimize the information security posture of the Commission. Conducts regular crisis management exercises to validate agency response plans. Engage with other external organizations to seek and identify opportunities for sharing best practices, strategies, resources and capabilities in support of the development and implementation of an innovative and effective program appropriate to a Federal financial regulatory agency.

You will be evaluated on the basis of your level of competency (knowledge, skills and abilities) in the following areas: Leadership Developing Others Attention to Detail Customer Service Decision Making Information Management Interpersonal Skills Oral/Written Communication Problem Solving Reasoning Teamwork Technical Competence

Education is not required, nor may it be substituted for specialized experience. Please refer to the OPM Qualifications Standard listed in the "Qualifications Section" of this announcement.