*PLEASE NOTE THAT THIS VACANCY ANNOUNCEMENT IS ONLY OPEN TO CURRENT UNITED STATES POSTAL SERVICE OFFICE OF INSPECTOR GENERAL, UNITED STATES POSTAL SERVICE, UNITED STATES POSTAL INSPECTION SERVICE AND POSTAL REGULATORY COMMISSION EMPLOYEES. OTHER APPLICANTS WILL NOT BE CONSIDERED.
MINIMUM QUALIFICATIONS You must meet ALL of the minimum qualifications listed below. Bachelor's Degree in Cybersecurity/Information Technology Security or related field of study from an accredited college or university OR Applicant must have at least 5 years of hands-on specialized experience in application security testing AND Must have at least 5 years of specialized experience with hands-on skills in performing application security assessments Must have at least 5 years of specialized experience in Secure SDLC and Source Code Analysis (Manual &Tools) on Web-based Applications Must have hands-on experience with Static and Dynamic Application Security Testing using tools like HP Fortify, HP WebInspect, HCL Appscan, Snyk, Checkmarx, Synopsys, and Veracode Must have specialized experience in Continuous Integration (CI) and Continuous Deployment (CD) practices Must have specialized experience in manual code review with the ability to identify potential vulnerabilities and best coding practices Must have specialized experience in application vulnerability and security assessments using various tools like Burp Suite Pro, OWASP Zap Proxy, DirBuster, Kali Linux, Metasploit Pro, Accunetix, Insight AppSec, GitLab, Coverity, Fortify, and GitHub Enterprise Must have specialized experience in assessing application vulnerabilities and bugs in various applications Must have specialized experience creating security testing pipelines and test plans Must have specialized experience in implementing and deploying an organization-wide Application Security program (DAST and SAST) at the enterprise level to identify, report and remediate security vulnerabilities in development and production environments Must have knowledge of coding languages such as Java, .NET, Python, PHP, C++, C# Must have extensive experience in preparing test Plans, writing test Cases, test Execution and follow up remediation efforts DESIRABLE QUALIFICATIONS Microsoft 365 Certified Security Administrator Associate Microsoft Certified Azure Security Engineer Associate Advanced degree in Cybersecurity or related field Currently Industry Certifications in one or more of the following (or equivalent) Certified Secure Software Lifecyle Professional (CSSLP) Certified Cloud Security Professional (CCSP) Offensive Security Certified Professional (OSCP) EC-Council Certified Application Security Engineer (CASE) GIAC Certified Web Application Defender (GWEB) Azure Developer Associate EVALUATION FACTORS You must have the experience, knowledge and skills as listed in EACH of the evaluation factors. Failure to demonstrate that you meet all of the evaluation factor requirements as listed below will result in a score of zero (0); an ineligible status, and you will not be referred for further consideration. Include your major accomplishments relevant to the position requirements in your resume. Demonstrated expertise in configuring, deploying and utilizing both dynamic and static application security testing tools. Demonstrated knowledge of application-based, host-based, and network-based security best practices. Knowledge in applying advanced information technology principles, concepts, methods, standards, and practices sufficient to develop and interpret policies, procedures, and strategies governing the planning and delivery of services throughout the agency. Demonstrated ability to cultivate relationships across multiple teams to effectively implement security recommendations. Demonstrated ability to communicate effectively both orally and in writing with audiences of various levels of technical understanding. You will no longer be considered for this position if you receive a zero (0) rating on any evaluation factor. Failure to demonstrate that you meet all evaluation factor requirements will result in a score of zero (0). Upon receipt of a zero score, you will be deemed "not minimally qualified," and you will not be referred for further consideration.
This announcement provides the opportunity for a reassignment/promotion to the Information Technology Security Specialist position in the Office of Chief Information Officer (CIO) located in Arlington, VA. Bring your skills and voice to our team! The successful candidate will be a technical expert authority responsible for the application security function and for information technology security (Cybersecurity/InfoSec) engineering, and design. Responsibilities include solving significant problems complicated by interfaces and inter-relationships between and among programs, systems, functions, applications, and numerous critical issues for agency-wide information technology solutions, operations, and maintenance supporting the security of agency infrastructure, systems, and information. Candidates will be evaluated on the skills that they possess that are directly related to the duties of the position and the experience, education and training that indicate the applicant's ability to acquire the particular knowledge and skills needed to perform the duties of the position. Only those candidates who meet all qualification and eligibility requirements and who submit the required information by 11:59 PM EST on 09/24/2025 will be considered. The USPS OIG uses a Pay Banding system, which is equivalent to the Federal GS scale. Grade and salary determinations will be made based upon a candidate's education and professional experience. This position is being advertised at the Specialist Band level, equivalent to a GS-14. The salary range for this position is $142,488.00 - $185,234.00. The salary figures include locality pay. Please note that the duties and responsibilities associated with this position may vary based upon the agency's needs at the time of hire. The following description of major duties and responsibilities is only intended to give applicants a general overview of the expectations. Establishes, implements, and interprets the requirements for agency compliance with policy directives governing cybersecurity protection. Performs thorough security operations center analysis of potentially malicious or suspicious threats. Effectively administers and sustains enterprise level application security scanning tools for all COTS, GOTS, Web Applications, and internally developed cloud-based applications. Conducts risk and vulnerability assessments of planned and installed information systems applications to identify vulnerabilities, risks, and protection needs. Conducts systems security evaluations, audits, and reviews. Develops cybersecurity plans, processes, and procedures. Participates in network and system design to ensure implementation of appropriate cybersecurity policies as they relate to application security. Facilitates the gathering, analysis, and preservation of evident used in the prosecution of cybercrimes. Updates or establishes new application security requirements. Assesses security events to determine impact and implementing corrective actions. Ensures the rigorous application of information security/cybersecurity policies, principles, and practices in the delivery of all IT services. Identifies current and potential problem areas. Monitors agency compliance with application cybersecurity protection requirements across IT programs. Ability to handle multiple tasks and work independently as well as in a team.