Supervisory IT Cybersecurity Specialist

Supervisory IT Cybersecurity Specialist

Department: Other Agencies and Independent Organizations

Location(s): Washington, District of Columbia

Salary Range: $203134 - $228000 Per Year

Job Summary: The National Gallery of Art welcomes all people to explore art, creativity, and our shared humanity. Millions of people come through our doors each year, with even more online, making us one of the most visited art museums in the world. Our renowned collection includes over 160,000 works of art, from the ancient world to today. Admission to the West and East Buildings, Sculpture Garden, special exhibitions, and public programs is always free.

Major Duties:

• The Deputy Chief Information Officer / Chief Information Security Officer (DCIO/CISO) plays a critical leadership role in shaping enterprise technology strategy and advancing cybersecurity capabilities across the National Gallery of Art. The position provides executive oversight of the information security program and end-user technology services, ensuring the protection of digital assets and the reliable delivery of IT services that support mission-critical operations. Working in close partnership with the CIO, the DCIO/CISO helps drive strategic initiatives, optimize technology investments, and establish governance, standards, and performance measures that enable staff to effectively engage with and steward the Gallery's collections and operations. Serves as the most senior authority on cybersecurity for the Gallery, with responsibility for developing, approving and enforcing enterprise-wide cybersecurity policies, standards and control frameworks aligned with NIST, FISMA/FIPS, OMB guidance and other applicable federal requirements. Establishes and maintains the strategic cybersecurity roadmap, including defined maturity targets and performance metrics. Directs enterprise risk assessments, third-party vendor management, threat detection and incident response. Provides executive-level reporting on cybersecurity posture, risk exposure and remediation strategies to senior leadership and governance bodies. Ensures that cybersecurity requirements are fully integrated into acquisitions, system development, cloud services and vendor management activities. Directs the User Services Department (TDS-US), overseeing Tier 1 through 4 support, endpoint engineering, asset lifecycle management and identity and access management. Ensures effective collaboration and integration among User Services, Information Security and IT Operations, while maintaining a proactive, customer-focused IT experience that delivers positive outcomes. Establishes service-level objectives and performance metrics to ensure secure and reliable end-user computing services; manages remediation of cybersecurity vulnerabilities, baseline compliance and system upgrades in alignment with defined KPIs and targets to protect against cyber threats. Oversees the IT Asset Management program, including long-range technology replacement planning to provide high performing systems for staff productivity. Maintains a software and services catalog while identifying opportunities to consolidate applications to simplify management and reduce organizational cost. Works with full delegated CIO authority, in the absence of the CIO, to lead the organization and exercise executive decision-making. Partners closely with the CIO to shape enterprise IT strategy, capital planning and performance management frameworks. Represents TDS in enterprise governance bodies, risk management councils and emergency operations forums. Provides executive-level guidance on Technology risk, modernization priorities and strategies that strengthen operational resilience across the institution. Supervises senior managers and professional staff while leading enterprise strategic planning for cybersecurity and end-user computing, including defining documented outcomes, performance metrics and targets aligned to the Gallery's strategic plan and benchmarking excellence. Oversees workforce planning, performance management, succession planning and leadership development for the Information Security and User Services Teams. Cultivates a culture of accountability, innovation, customer service and continuous improvement. Responsible for the development and execution of budgets for Information Security and User Services, including managing operating budgets, resource plans, and financial forecasts. Serves as a senior-level Contracting Officer's Representative (COR) for security and user services contracts, with primary oversight of the helpdesk and endpoint computing services. Ensures contracted services meet performance expectations, comply with requirements, and promote accountability.

Qualifications: Specialized Experience Statement: To meet the minimum qualifications for this position, candidates must possess a minimum of one year of specialized experience at or equivalent to grade level GS-15 in the public, private, or non-profit sectors . Specialized experience is defined as: 1) Leading enterprise cybersecurity programs and policy in a complex organization; 2) Developing and enforcing cybersecurity standards and control frameworks aligned with federal requirements; 3) Directing cyber risk management, incident response, and security performance reporting; exercising executive leadership in enterprise IT strategy, governance, capital planning, and operational resilience; 4) Overseeing end-user computing or user services functions that include help desk operations, endpoint engineering, identity and access management, and asset lifecycle management; 5) Supervising senior managers or multidisciplinary professional staff; and 6) Managing budgets, forecasts, and high-value IT contracts, including serving in a senior contract oversight or COR capacity. OPM Qualifications Standard: Individual Occupational Requirements: Information Technology (IT) Management Series 2210 (Alternative A) MANDATORY QUALIFICATIONS: Applicants must address the following mandatory qualifications separate from their resumes. Statements must provide specific examples that address relevant experience, accomplishments and evidence that you possess demonstrated superior technical qualifications. You will not be considered for this position if you fail to submit qualification statements specifically addressing each mandatory technical qualification requirement. Mandatory Technical Qualifications (MTQs): Maximum of two pages per MTQ. MTQ 1. Mastery of the theories, concepts, standards and practices of Information Technology (IT) enterprise portfolio management and leadership, with particular emphasis on effective strategic planning and implementation. This includes the ability to coordinate, plan, and direct projects staffed with representatives of highly collaborative, cross-functional teams to ensure successful completion. MTQ 2. Mastery of the principles, methods, services, best practices and techniques used in the IT field and their application to advance and enable business strategic priorities. This requires the possession of expert knowledge of the critical role Information Technology plays in advancing and supporting business and mission priorities. This includes the ability to apply this expert knowledge in the context of a large organization with a variety of complex program responsibilities. MTQ 3. Leverages expert knowledge of advancements in the information technology industry to address mission and business issues and challenges; to develop and implement cutting edge, innovative solutions for the organization; to plan and conduct feasibility studies, and to advise senior organizational management concerning resource management strategies. MTQ 4. Leading Change: This core qualification involves the ability to bring about strategic change, both within and outside the organization, to meet organizational goals. Inherent to this core qualification is the ability to establish an organizational vision and to implement it in a continuously changing environment. MTQ 5. Leading People: This core qualification involves the ability to lead people toward meeting the organization's vision, mission, and goals. Inherent to this core qualification is the ability to provide an inclusive workplace that fosters the development of others, facilitates cooperation and teamwork, and supports constructive resolution of conflicts. Other Relevant Eligibility Criteria: Must maintain availability for executive incident response and occasional work outside normal business hours May be required to carry a Gallery-issued phone during non-work hours. Your responses to the MTQs will be evaluated based on how clearly and concisely you emphasize your level of responsibilities, particularly, the scope and complexity of the programs, activities, or services managed; program accomplishments; policy initiatives undertaken; level of contacts; the sensitivity and criticality of the issues addressed; and the results of actions taken. You are required to submit separate narrative statements for each MTQ to receive consideration for this position. Please see the REQUIRED DOCUMENTS section for complete details regarding the page limitation and formatting requirement. Applicants must carefully review the information in the "How You Will Be Evaluated" section for important information and instructions pertaining to the multi-hurdle assessment process for this position. While not required by regulation, agencies may require that at least 1 year of the specialized experience must be at least equivalent to experience at GS-15 (5 CFR 319.301(c)(2)). Only experience and education obtained by the closing date of this announcement will be considered. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience.

How to Apply: Please read the entire announcement and all the instructions before you begin an application. To apply for this position, you must complete the online application and submit the documentation specified in the Required Documents section of this vacancy. The complete application package must be submitted by 11:59 PM (EST) on the closing date to receive consideration. If you have questions about this job, please contact the HR Office representative listed in the "Agency Contact Info" section of this vacancy announcement. If you need assistance in applying on-line, please refer to the How to Apply section below and explore the Federal Application Process information on the USAJobs website. To begin, click Apply Online to access an online application. Follow the prompts to select your USAJOBS resume and/or other supporting documents. You will need to be logged into your USAJOBS account or you may need to create a new account. You will be taken to an online application. Complete the online application, verify the required documentation, and submit the application. Read the Eligibility questions carefully. The questions address if you are eligible to apply to this JOA. Your responses will affect your consideration for the position. You may qualify for more than one eligibility, so please choose carefully. You will only be considered under the options you have selected. If you respond that you do not meet any of the eligibility questions, you will not be considered for this position. You will receive an email notification when your application has been received for the announcement. If experiencing a significant hardship which hinders your ability to apply on-line, please contact the Agency Contact listed on this announcement at least two business days before the closing date, to discuss your situation. Failure to contact us within sufficient time may result in your hardship request being denied. The National Gallery of Art receives many applications for each job. Each application is reviewed carefully which may take a few weeks. To verify the status of your application, log into your USAJOBS account, https://my.usajobs.gov/Account/Login, select the Application Status link and then select the More Information link for this position. The Application Status page will display the status of your application, the documentation received and processed, and your responses submitted to the online application. Your uploaded documents may take several hours to clear the virus scan process. Do not submit photographs with your application package. Documents with photographs may not be seen by hiring officials - you must remove your image from any badges, licenses, etc. If your resume includes a photograph or other inappropriate material or content (e.g. SSN or DOB), your resume will not be used to make eligibility and qualification determinations and you will not be considered for this vacancy. Documents submitted as part of the application package, to include supplemental documents, may be shared beyond the Human Resources Office. Some supplemental documents such as military orders and marriage certificates may contain personal information for someone other than you. You may sanitize these documents to remove another person's personal information before you submit your application. You may be asked to provide an un-sanitized version of the documents if you are selected to confirm your eligibility. Do not upload Adobe portfolio documents. Adobe portfolio documents are not viewable by our agency's staffing offices.

Application Deadline: 2026-05-15