Cybersecurity Compliance Office Lead (O-6 Billet) Supervisory

Summary

The Cybersecurity Compliance Office Lead role supervises program managers, coordinates authorization and continuous-monitoring activities, manages risks and compliance milestones, supports acquisition and contract teams, and provides leadership with readiness assessments and recommended actions. This position is only open to current USPHS officers. USPHS Call to Active Duty (CAD) candidates are not eligible for this position.

Duties

DUTIES AND RESPONSIBILITIES: Supervises and leads a team of three Cybersecurity and Privacy Program Managers responsible for cybersecurity and privacy compliance workstreams. Establishes workload distribution, priorities, timelines, documentation standards, and quality expectations for the office. Serves as the accountable CAMS leader for program and portfolio management of cybersecurity and privacy compliance work across the IHSC health information technology portfolio. Directs management of milestones, schedules, dependencies, action items, risk visibility, and required coordination activities. Ensures cybersecurity and privacy requirements are identified during acquisition planning and reflected in acquisition requirements documentation before an acquisition is referred to the contracting office. Coordinates with the Acquisition Planning Office to ensure compliance requirements are incorporated early in the acquisition lifecycle. Oversees office support provided in coordination with the ICE Office of the Chief Information Officer for authorization-related activities, including Risk Management Framework documentation, required artifacts, milestones, and coordination with system owners, Authorizing Officials, and information system security officers. Maintains visibility of continuous-monitoring activities across the portfolio, including compliance status, open findings, corrective actions, dependencies, and aging items requiring attention. Ensures significant compliance issues are tracked, assigned, elevated, and resolved through the appropriate authorized officials. Establishes Government programmatic priorities and requirements for assigned cybersecurity and privacy compliance activities. Coordinates contractor performance through the Contracting Officer or an appointed Contracting Officer's Representative, as appropriate, while preserving Government decision-making authority. Coordinates with privacy officials to ensure potential privacy implications are identified early and formal privacy reviews occur at an appropriate point in the acquisition and system lifecycle. Ensures privacy-related requirements, risks, and actions are documented and routed to officials holding formal authority. Coordinates with the Portfolio Management Office to ensure cybersecurity and privacy milestones, dependencies, constraints, and risks are accurately reflected in enterprise schedules, planning documents, and portfolio-management activities. Coordinates with the Acquisition Planning Office and Contract Governance Office to ensure cybersecurity and privacy obligations carry through from acquisition planning into contract performance, oversight, and transition activities. Identifies, assesses, and escalates material security, privacy, and compliance risks. Provides CAMS and HITU leadership with recommendations, readiness assessments, and analysis of likely programmatic, schedule, cost, and mission impacts. Provides unit leadership with portfolio status reports, compliance-posture summaries, risk assessments, and readiness information supporting executive decision-making. Translates technical cybersecurity and privacy information into clear programmatic impacts and recommended actions for executive leadership, program officials, and acquisition personnel. Develops and implements office operational plans, procedures, documentation standards, recordkeeping practices, and process improvements necessary to achieve CAMS and HITU objectives. Captures institutional knowledge to support continuity through personnel transitions. Performs supervisory duties, including performance management, work planning, coaching, mentoring, employee development, and accountability for assigned officers. Identifies developmental needs and ensures completion of required position-specific training. Establishes and enforces appropriate information-protection practices. Ensures proper handling of procurement-sensitive, proprietary, security, privacy, and system information. Performs other duties as assigned.

Qualifications

PHYSICAL DEMANDS: Sit and/or stand for extended periods of time, generally six to eight hours. Perform repeated bending motions. Use average manual dexterity for computer operation. Use a telephone for extended periods. If the incumbent is a clinician, the incumbent may be required to perform temporary duty assignments in support of field operations for a minimum of two weeks and a maximum of 30 days annually.

Education

REQUIRED KNOWLEDGE, SKILLS, AND ABILITIES: Ability to lead multidisciplinary projects, workstreams, and portfolios involving program, acquisition, technical, cybersecurity, privacy, and compliance stakeholders. Working knowledge of cybersecurity and privacy compliance practices, including authorization activities, compliance documentation, risk management, and continuous monitoring, sufficient to manage work and recognize material risks. Ability to understand technical cybersecurity and privacy discussions, ask informed questions, and translate technical findings into programmatic, schedule, cost, and mission impacts. Knowledge of the acquisition lifecycle sufficient to ensure cybersecurity and privacy requirements are incorporated into acquisition planning and contract performance rather than addressed after award. Ability to supervise, develop, evaluate, and hold accountable assigned professional staff; assign work by portfolio; and establish clear ownership and performance expectations. Ability to coordinate contractor-provided technical support while maintaining appropriate Government authority and ensuring that Government decisions remain with authorized Government officials. Ability to communicate concisely and effectively with executive leadership, including presenting adverse security, privacy, or compliance information with a recommendation for action. Ability to recognize the boundary between coordinating activities involving an authority and exercising that authority, and to route decisions to the officials who hold the appropriate decision-making authority. Ability to build and sustain productive working relationships with program officials, acquisition personnel, technical specialists, privacy officials, cybersecurity officials, system owners, contractors, and executive leadership. Ability to establish, maintain, and enforce documentation and recordkeeping standards while protecting sensitive acquisition, security, privacy, proprietary, and system information. Ability to exercise sound, independent judgment in managing complex, sensitive, and mission-critical programmatic issues. Ability to adapt to changing priorities, schedules, workload requirements, and mission needs. MINIMUM QUALIFICATIONS Applicants must meet the education and professional requirements applicable to their USPHS professional category. No specific academic discipline is required for this position. Applicants must demonstrate progressively responsible program-management experience, including experience leading or supervising professional staff and coordinating work performed by technical specialists. Applicants must have at least two years of experience in one or more of the following areas: Cybersecurity, information security, information assurance, information technology governance, or related work; Privacy, information governance, compliance, risk management, or related work; Authorization support, continuous monitoring, Risk Management Framework activities, or related compliance work; Program management, project management, contr