Summary This position is located in the Compliance Branch of the Division of Market Oversight (DMO). DMO's mission is to be transparent, fair, competitive, and secure markets through clear rules and effective oversight of derivatives markets and market participants. DMO seeks to be the world’s foremost authority on the rapidly evolving derivatives markets. Duties At the full performance level, you will serve as a Systems Risk Analyst in the Compliance Branch (Branch) of the Division of Market Oversight (DMO), as senior staff of the Branch's Market Continuity Program (MCP). Using advanced knowledge of information technology (IT) concepts and of standards, guidelines, and best practices regarding system safeguards and security control reviews, you will conduct the CFTC's oversight of compliance by Designated Contract Markets (DCMs), Swap Data Repositories (SDRs), and Swap Execution Facilities (SEFs) with the system safeguards requirements of the Commodity Exchange Act (Act) and CFTC regulations. Additionally, you will;
Plan and conduct System Safeguards Examinations (SSEs) and Targeted Maturity Assessments (TMAs) of all DCMs, SDRs, and SEFs, to evaluate the reliability, cyber and physical security, adequate scalable capacity, internal oversight, and testing of their automated trading and data reporting systems, and the compliance of their programs of system safeguards risk analysis and oversight with the requirements of the Act and CFTC regulations.
Serve as one of DMO's senior IT and system safeguards experts for performance of system safeguards oversight that is complex, sensitive, and of high importance to the mission of the CFTC.
Serve as an expert on teams conducting system safeguards examinations (SSEs) of DCMs, SEFs, and SDRs to assess their compliance with the system safeguards requirements of the Act and Commission regulations. SSEs address DCM, SEF, and SDR compliance with core principles requiring the regulatee to: establish and maintain a program of risk oversight to identify and minimize sources of operational risk through development of appropriate controls and procedures and development of automated systems that are reliable, secure, and have adequate scalable capacity; establish and maintain emergency procedures, backup facilities, and a plan for disaster recovery that allow for the timely recovery and resumption of operations and the fulfillment of the duties and obligations of the regulatee; and periodically conduct tests to verify that backup resources are sufficient.
SSEs focus on seven risk oversight program areas, including:
- Enterprise risk management and governance;
- Information security;
- Business continuity and disaster recovery, including pandemic planning;
- Capacity and performance planning;
- Systems operations;
- Systems development and quality assurance; and
- Physical security and environmental
In leading or participating on an SSE or TMA team, the incumbent will:
- organize and conduct review of documents provided by the DCM, SDR, or SEF examined;
- conduct extended on-site interviews, as a senior expert on the interview team, with regulatee senior management and technical staff;
- apply extensive, expert knowledge of risk oversight, IT principles, appropriate controls and procedures, and best practices for automated systems to the analysis of information developed in the course of the SSE or TMA, and play a significant participatory role at an expert level in MCP staff determination of appropriate findings and recommendations;
- draft a detailed report of MCP findings and recommendations;
- participate as a senior-level expert in communicating findings and recommendations to senior management and technical staff of the DCM, SDR, or SEF examined; and
- assess the efficacy and timeliness of corrective action taken by the DCM, SDR, or SEF
The incumbent represents the MCP on DMO teams reviewing applications from entities seeking designation as a DCM or registration as an SDR or SEF. The incumbent serves as an expert in technical reviews by MCP staff of the applicant's compliance with system safeguards requirements for entities seeking the designation or registration in question. The incumbent also expertly communicates with applicants during the registration or designation process and participates as a senior-level expert in MCP staff evaluation of applicant sufficiency in light of applicable system safeguards requirements, and drafts system safeguards-related portions of related reports and registration or designation orders. The incumbent may be required to independently conduct such technical reviews, including on-site registered entity and data center visits.
Qualifications
CT-13 Level: To qualify for the CT-13 level, you must have at least one year of specialized experience equivalent to the next lower grade level (CT/GS-12) in the Federal service, or comparable experience not gained through federal service.
Specialized experience is defined as:
- Experience applying knowledge of IT concepts, standards, guidelines, and techniques regarding system safeguards and security control reviews;
- Experience in overseeing compliance of systems as it relates to the electronic trading environment; cyber and physical security, scalable capacity, internal oversight, and testing of automated trading and data reporting systems; and
- Experience in evaluating emergency procedures, backup facilities, and disaster recovery plans electronic trading systems.
One or more professional certifications in the following system safeguards and in the Information Technology industry are highly desired:
- Certified Information Systems Security Professional (CISSP);
- Certified Information Systems Auditor (CISA);
- Certified Business Continuity Professional (CBCP);
- Certified Data Center Professional (CDCP);
- Certified in the Governance of Enterprise IT (COEIT);
- Systems Security Certified Practitioner (SSCP);
- Certified Authorization Professional (CAP);
- Certified Security Software Lifecycle Professional (CSSLP);
- Certified Internal Auditor (CIA);
- Certified Information Security Manager (CISM);
- Certified in Risk and Information Systems Control (CRISC);
- Certified Functional Continuity Professional (CFCP);
- Master Business Continuity Professional (MBCP);
- Business Continuity Certified Planner (BCCP);
- Business Continuity Certified Lead Auditor (BCCLA);
- Disaster Recovery Certified Specialist (DRCS).
Education Please refer to the OPM General Business and Industry Series 1101 for the specific qualification requirements for this position.
Requirements
You will be evaluated on the basis of your level of competency (knowledge, skills and abilities) in the following areas:
Information Technology Architecture - Knowledge of architectural methodologies used in the design and development of information systems, including the physical structure of a system's internal operations and interactions with other systems.
Technical Competence - Uses knowledge that is acquired through formal training or extensive on-the-job experience to perform one's job; works with, understands, and evaluates technical information related to the job; advises others on technical issues.
Risk Management - Knowledge of the principles, methods, and tools used for risk assessment and mitigation, including assessment of failures and their consequences.
Communication (Oral/Written) - Makes clear and convincing oral presentations. Listens effectively; clarifies information as needed.Recognizes or uses correct English grammar, punctuation, and spelling; communicates information (for example, facts, ideas, or messages) in a succinct and organized manner; produces written information, which may include technical material, that is appropriate for the intended audience. How you will be evaluated This recruitment will utilize the following assessment tools: Structured Evaluative Review
Subject Matter Experts (SME) will independently review your resume and other supporting document to assess how well your experience demonstrates the required competencies for this position listed in the "Requirements" section of the this announcement. The SME will assign scores based on the strength, relevance, and clarity of the information provided in your resume. These individual evaluations will determine your final score.
When the application process is complete, we will review your resume and other supporting documentation, to ensure you meet the hiring eligibility and qualification requirements listed in this announcement.
You may preview questions for this vacancy. How to apply RESUME REQUIREMENT: Your resume may NOT exceed two pages, and the font size should not be smaller than 10 pts. Please ensure your resume clearly demonstrates how you meet the qualifications for the position within the two-page limit.
YOU MUST APPLY ONLINE: Your complete application, including required documents, must be received by 11:59 p.m. Eastern Time (EST) on the closing date of this announcement. You must complete and submit an application by accessing the USAJOBS website at USAJOBS.GOV. To begin, click the Apply Online button within the vacancy announcement and follow the prompts to create an account using LOGIN.GOV, if you have not done so already. LOGIN.GOV will walk you through each step of the account set-up and will automatically link your USAJOBS profile to LOGIN.GOV. Once you have established an account using LOGIN.GOV, you will then go back to USAJOBS.GOV using your LOGIN.GOV username and password to answer the questions and submit all required documents. If you already have established an LOGIN.GOV account or want to return to your saved application, go to USAJOBS.GOV using your LOGIN.GOV username and password to apply or view your profile. If you have problems completing your on-line application, including problems submitting your supporting documents, please contact the Help Desk by e-mail at mgshelp@monster.com or phone at 1-866.656.6831. The help desk is available Monday-Friday, 7:00 a.m. to 7:00 p.m. EST.
To verify the status of your application, log into your USAJOBS account (https://my.usajobs.gov/Account/Login), all of your applications will appear on the welcome screen. The Application Status will appear along with the date your application was last updated. For information on what each Application Status means, visit: https://www.usajobs.gov/Help/how-to/application/status/. Other information This is a Bargaining Unit Position located in the National Treasury Employee Union (NTEU) Chapter 337.
Relocation: Relocation expenses will not be paid.
Probationary/Trial Period:
As a condition of employment for accepting this position, you may be required to serve a 1-year probationary or a 2-year trial period during which we will evaluate your fitness and whether your continued employment advances the public interest. In determining if your employment advances the public interest, we may consider:
- Your performance and conduct;
- The needs and interests of the agency;
- Whether your continued employment would advance organizational goals of the agency or the Government; and
- Whether your continued employment would advance the efficiency of the Federal service. Upon completion of your probationary/trial period your employment will be terminated unless you receive certification, in writing, that your continued employment advances the public interest.
Time-in-Grade: You must meet time-in-grade requirements within 30 days of the closing date of this announcement, if applicable.
More than the number of positions listed may be filled through this vacancy announcement.
The overall salary range is provided for informational purposes as it represents the full range that is applicable to current employees in this occupation/grade. A new hire's direct and overall experience are critical factors in determining a salary offer, therefore, it is important that your resume fully reflects all of your work experience. Note that the upper end of each range is typically applicable only to candidates with significant years of work experience and qualifications Please review the CFTC Compensation Program website for additional information.
The law prohibits public officials from appointing, promoting, or recommending their relatives. The law prohibits requesting, making, transmitting, accepting, or considering political recommendations for employment or other personnel actions for non-political positions. This includes recommendations from Members of Congress, Congressional employees, elected state or local officials, and political party officials and any recommendation based on party affiliation.