Cybersecurity Senior Specialist

Cybersecurity Senior Specialist #5387 Target Hiring Range: $120,000-$135,000 Department: Chief Information Officer Posting Date Range: 7/14/2026 - 7/28/2026 Pay Grade Range: $102,745 - $173,959 Work Hours: 8:30 am – 5:30 pm FLSA Status: Exempt Work Location Status: Hybrid Hybrid Schedule: 2–3 days a week onsite. All remote or hybrid work arrangements must be performed within the continental United States, subject to Sergeant at Arms approval. Relocation: The Senate Sergeant at Arms does not pay for relocation expenses. Application Deadline: This vacancy announcement closes at 7pm EST. Late applications will not be accepted. JOB OVERVIEW Job Description. Target Hiring Range: $120,000‑$135,000 About Us: The Sergeant at Arms helps uphold the operational integrity of the Senate community. The Cybersecurity Department protects the systems and information used to create the legislation that underwrites our democracy. We build a resilient cybersecurity operation by proactively identifying, protecting, detecting, reacting, and recovering (IPDRR) across the U.S. Senate enterprise through a modern, continuous risk‑reduction practice. Role Overview: The Cybersecurity Senior Specialist supports technical analysis and operations within the Threat Intelligence Branch, combining threat hunting and mobile forensic analysis to identify, analyze, and mitigate sophisticated threats targeting enterprise users and systems. The role also helps define and enforce team standards, policies, and procedures to strengthen repeatable, high‑quality analysis and operational outcomes. Key Accountabilities / Essential Job Duties Provides functional and/or technical skills for the assigned cybersecurity unit. Supports the unit’s work effort as required in preparing materials for collaborating with other sections, divisions, departments, and vendors to gather and disseminate information. Contributes to the unit’s work effort as required in preparing analysis and materials for providing expert‑level support in the assigned area of cybersecurity to SAA IT security branch staff, other SAA technical staff, SAA procurement staff, and other divisions or departments, and for identifying and resolving critical and complex issues in the assigned unit. Supports the unit’s work effort as directed in providing leadership to the unit’s project teams and contractors. Work includes helping to develop plans, assignments, and coordination of work efforts. Supports the unit’s work effort to develop governing policies, standards, and procedures. Other duties as assigned. JOB SPECIFICATIONS Required Education: High School Diploma (or GED). Key Responsibilities: In this role, you will help protect the organization’s digital assets and support mission‑critical cybersecurity operations by performing work such as: Mobile Device Forensics (iOS & Android): Conduct forensic acquisition and analysis of mobile devices using mobile analysis tools, analyze application artifacts, malicious mobile payloads, and persistence mechanisms, identify credential harvesting, spyware, or exploitation attempts. Develop and improve team processes for mobile triage, collection, analysis, and reporting to increase consistency, speed, and custom defensive mitigations. Mobile Malware Analysis: Conduct advanced static and dynamic malware analysis to determine functionality, behavior, persistence, C2, evasion, and attribution‑relevant indicators; produce actionable findings for defensive operations. Triage suspicious mobile apps and artifacts (APKs, IPAs, app bundles, configuration profiles, supporting logs) to determine maliciousness, user impact, and containment needs. Track and compare samples/campaigns over time to identify clustering, reuse, attribution‑relevant patterns (when appropriate), and opportunities to harden defenses against recurring mobile threats. Threat Intake & Triage: Analyze user‑submitted reports and other operational team submissions with emphasis on mobile‑related incidents and artifacts. Perform supporting URL/domain analysis to uncover credential harvesting, malicious redirects, spoofing tactics, drive‑by downloads, and related mobile delivery vectors. Conduct targeted email/phishing analysis when mobile compromise is suspected or when artifacts indicate a broader campaign. Communication and Collaboration: Provide daily updates to team members and leadership on activities. Collaborate with other cyber teams (incident response, SOC, and threat intelligence teams) when appropriate and analysis determines is operationally necessary. Documentation: Able to take the results of long and highly technical investigations and work with teammates to capture them in a manner that is clear, readable, and able to drive future operations. Other duties assigned. Required Work Experience: Five to seven years of progressively responsible experience in cybersecurity, including leadership roles in project teams or units. Subject matter expertise in a cybersecurity domain. Demonstrated proficiency in addressing critical and complex cybersecurity challenges, providing expert‑level support, and coordinating work efforts across teams and external vendors. Experience in developing and enforcing cybersecurity standards, policies, and procedures. Required Special Skills / Knowledge: As part of our hiring process, we may conduct a skills assessment to better understand an applicant’s proficiency in key areas relevant to the role. Desired Qualifications Growth mindset: Drive to continuously improve technical tradecraft. Proactive attitude: Proven track record of taking initiative to solve problems creatively and effectively. Cyber knowledge: Understanding of cybersecurity principles and familiarity with common actors’ TTPs and common attack chains. Forensic analysis capability: Expertise in mobile device operating systems, file systems, and executable formats. Time management: Ability to handle multiple taskings in a fast‑paced environment and act without causing undue delay. Analysis and production: Methodical analysis and sound judgment. Ability to analyze (static and dynamic) malware samples, URLs, and mobile devices to uncover potential malicious or suspicious activity, and high‑quality documentation. Research: Ability to evaluate information for reliability, validity, and relevance. Communication: Clear verbal and written communication skills for technical and non‑technical audiences. Customer service: Experience working with a diverse range of customers to assess needs, recommend solutions, and guide mitigation actions appropriately. Working Conditions This position directly supports essential services of the U.S. Senate. As such, this position requires the employee to be available and prepared to work during a lapse in appropriations, in inclement weather, on holidays, weekends, and during late nights to ensure essential services to the Senate continue without interruption. In the context of government furloughs, this position is considered excepted. The U.S. Senate network cannot be taken offline for maintenance during the workday or while the Senate is in session. As such, maintenance windows may only occur at night, on weekends, and occasionally on holidays. Employees who perform systems upgrades, maintenance, wiring, backups, or support our alternate data centers will have schedules that include working nights, weekends, and holidays. Sedentary. This position may require the incumbent to be available for sudden recall in response to emergency events affecting the Senate campus or community, which may include after‑hour or weekend work, and to potentially deploy to alternate sites in support of the Senate’s contingency operations. (TCR) Security Clearance This position requires that the applicant obtain and maintain a Secret U.S. Government security clearance. Applicants must be U.S. citizens in order for the SAA to submit your application for a security clearance. CONDITIONS OF EMPLOYMENT To be employed by a Senate employing office in a paid position in the continental United States, an individual must: Be a U.S. citizen; Be lawfully admitted for permanent residence and seeking citizenship as outlined in 8 U.S.C. § 1324b(a)(3)(B); Be (i) admitted as a refugee under 8 U.S.C. § 1157 or granted asylum under 8 U.S.C. § 1158 and (ii) have filed a declaration of intention to become a lawful permanent resident and then a citizen when eligible; or Owe allegiance to the U.S. (i.e., qualify as a non‑citizen U.S. national under federal law). Employment is contingent on background / security investigation results. BENEFITS AT-A-GLANCE The SAA provides a highly competitive benefits package for all SAA staff. Our benefits extend beyond health care coverage to help provide employees with student loan reimbursement, professional development, transportation subsidy, TSP/retirement savings, access to our Employee Assistance Program, and more. For more information regarding SAA’s benefits, please visit ACCOMMODATIONS As an Equal Opportunity Employer, the SAA is committed to providing reasonable accommodations to applicants with disabilities. If you are interested in applying for employment with SAA and need special assistance or an accommodation to complete the application process, please submit your request to View email address on click.appcast.io with “Accommodation” in the subject line. VOLUNTARY SELF‑IDENTIFICATION FOR VETERANS' PREFERENCE If you are identifying as veterans' preference eligible under the VEOA, please use this link to complete your application for Veterans' Preference AFTER you apply for this position. The link will also be available on the “Thank You” page after you have submitted your job application. All supporting documents must ONLY be provided within the Veterans’ Preference Application and within the stated deadline of the job announcement. Late applications for veterans’ preference will not be considered. Documentation to obtain veterans’ preference will not be considered if attached to the job application. If you need to revise or resubmit your Application for Veterans' Preference/documents, please withdraw your previous Application for Veterans' Preference and resubmit. If you require assistance, please email View email address on click.appcast.io. To view additional information regarding the VEOA, please click here. An applicant who declines to self‑identify as a disabled veteran and/or to provide information and documentation regarding his/her disabled veteran’s status will not be subjected to an adverse employment action, but the individual may be ruled ineligible for veterans’ preference. #J-18808-Ljbffr