Application Security Engineer, CG-2210-14
About This Position
These positions are located in the Offices of the Chief Information Security Officer (OCISO) or Application Platforms and Delivery Branch (APDB), Division of Information Technology (DIT), within the Chief Information Officer Organization (CIOO) of the Federal Deposit Insurance Corporation (FDIC). Additional selections may be made from this announcement to fill similar vacancies.
Qualifications
Qualifying experience may be obtained in the private or public sector. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g. Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic, religious spiritual; community; student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment.
You will receive credit for all qualifying experience, including volunteer experience. Additional qualifications information can be found here. To qualify for the CG-14: Applicants must have at least one year of specialized experience equivalent to the CG-13 level in the federal service which includes experience in application security assessments, identifying vulnerabilities in code and architecture, validating secure coding practices, and guiding development teams in implementing remediation.
You must have Information Technology (IT)-related experience which demonstrates proficiency in each of the following competencies: • Attention to Detail - Is thorough when performing work and conscientious about attending to detail. • Customer Service - Works with clients and customers (that is, any individuals who use or receive the services or products that your work unit produces, including the general public, individuals who work in the agency, other agencies, or organizations outside the Government) to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations; knows about available products and services; is committed to providing quality products and services. • Oral Communication - Expresses information (for example, ideas or facts) to individuals or groups effectively, taking into account the audience and nature of the information (for example, technical, sensitive, controversial); makes clear and convincing oral presentations; listens to others, attends to nonverbal cues, and responds appropriately. • Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations. For qualification determinations, your resume must contain the following for each work experience listed: Organization/Agency's Name Title Salary (series and grade, if applicable) Start and end dates (including the month and year) Number of hours you worked per week Relevant experience that supports your response to the specialized experience that is stated in the job announcement If your resume does not contain this information, your application may be marked as incomplete, and you may not receive consideration for this position.
NOTE: Please indicate how you meet the specialized experience under each applicable position. Do not copy and paste the duties or specialized experience from this announcement into your resume as that will not be considered a demonstration of your qualifications. Applicants eligible for ICTAP (Interagency Career Transition Assistance Program) must achieve a score of 80 or higher in the online assessment to be determined “well qualified” for this position. For more information, click here.
Major Duties
Implement FDIC's Application Security strategy and roadmap. Develop, maintain and support the implementation of the FDIC API security strategy. Develop secure coding standards and improves secure software development processes.
Conduct application architecture risk analysis and threat modeling against applications and APIs. Support the application security program and collaborate with development teams in secure code reviews and application security testing, utilizing AST, DAST, SCA, IAST and other cybersecurity pen testing tools. Develop custom scripts and solutions to enhance application cybersecurity testing and analysis capabilities.
Support the integration of application cybersecurity tools into CI/CD pipeline to automate cybersecurity checks, ensuring API security is a part of automated process. Educate and train the development teams on best practices in application security and API security, and cybersecurity secure coding standards, and secure development methodologies.
Conditions of Employment
Registration with the Selective Service. U.S. Citizenship is required. Employment Conditions. Completion of Confidential Financial Disclosure may be required. Background Investigation (BI) required.
Education
There is no substitution of education for the experience for this position.
How You Will Be Evaluated
This is a Direct-Hire Public Notice. Applications will be accepted for the location identified in the public notice. Veteran's preference and traditional rating and ranking of applicants DO NOT apply to positions filled under this public notice.
All complete applications (transcripts must be included, if applicable) will be verified for eligibility requirements and will be submitted to the hiring official upon request. https://www.opm.gov/policy-data-oversight/hiring-information/direct-hire-authority/#url=Governmentwide-Authority Once the application process is complete, your two page resume and supporting documentation will be used to determine whether you meet the job qualifications. Structured Resume Review: Occupational Experts (OEs) will review your resume to determine your technical qualifications for this position based on the required competencies. OEs will review ONLY your two (2) page resume.
OEs will not review additional information beyond your resume (e.g., cover letter, links embedded in your resume). If you are found qualified, your application will move forward to additional phase(s) of the review process.
You will be assessed on the following competencies: Oral/Non-Written Communication Written Communication Information Security Vulnerbility Assessment & Management Coding/Programming Enterprise Architecture Systems Integration/Interpolarity Software Development Lifecycle (SDLC) You may preview questions for this vacancy.
Additional Information
DUE TO THE HIGH VOLUME OF QUALIFIED APPLICANTS EXPECTED TO APPLY, THIS ANNOUNCEMENT WILL CLOSE ON THE DAY THE 100TH APPLICATION IS RECEIVED, OR ON THE CLOSING DATE OF THIS ANNOUNCEMENT, WHICHEVER COMES FIRST. Salary reflects a pay cap for this position of $257,500 To read about your rights and responsibilities as an applicant for Federal employment, click here. If selected, you may be required to serve a probationary or trial period as applicable to appointment type.
During the probationary or trial period, you will be evaluated for fitness and whether your continued employment advances the public interest. In determining if your employment advances the public interest, we may consider: your performance and conduct; the needs and interests of the agency; whether your continued employment would advance organizational goals of the agency or the Government; and whether your continued employment would advance the efficiency of the Federal service. Upon completion of your probationary or trial period your employment will be terminated unless you receive certification, in writing, that your continued employment advances the public interest.
How to Apply
To begin, click the “Apply” button and follow the prompts. If you haven't already, register and establish a USAJOBS account.
After you register online, click the “Apply” button to complete the online assessment questionnaire, and submit all required documents. Please be sure to click “Submit Application” to complete the application process.
You must apply online. To apply for this position, you MUST provide a complete application package which includes: Your two (2) page resume showing all relevant work experience (paid and unpaid) including: duties performed; full name and address of the each employer; start and end dates (month/year); work schedule (part-time, full-time, number of hours if intermittent); salary; and any completed education and training (program title, subject area, number of hours completed, and completion date). Applicants requesting an exception from the online process must contact the Human Resources Specialist or point of contact listed in this announcement prior to 12:00 noon local time on the closing date.
To return to your saved application, log in to your USAJOBS account and click on “Applications” tab.
Click on the “Position Title,” and then select “Update Application” or “Additional Application Information” to continue. You have until 11:59 p.m. ET (Eastern Time) on the closing date of this announcement to complete the application process. Please ensure you have completed the application process by verifying the status of your application on-line to reflect: “Received”. Failure to complete the application process will result in an incomplete application and you will not be considered for the position.
Required Documents
INTERAGENCY TRANSITION ASSISTANCE PROGRAM (ICTAP): If you are a displaced Federal employee eligible for consideration under ICTAP, you must submit: Current (or last) performance rating of record of at least Fully Successful or equivalent Specific RIF (reduction in force) separation notice or a notice of proposed removal for declining a directed reassignment or transfer of function outside the local commuting area SF-50 that indicates RIF separation or "Retirement in lieu of RIF” For more information, click here Your two (2) page resume showing all relevant work experience (paid and unpaid) including: duties performed; full name and address of each employer; start and end dates (month/year); work schedule (part-time, full-time, number of hours if intermittent); salary; and any completed education and training (program title, subject area, number of hours completed, and completion date).