US Department of Treasury, OIG for Tax Administration – Lanham, MD

Criminal Investigator (Cybercrime Special Agent)


This position is located in the Cybercrime Investigations Division (CCID) within the Office of Investigations (OI) at the Treasury Inspector General for Tax Administration (TIGTA, Office of Investigations (OI). The incumbent reports to the Assistant Special Agent in Charge (Cybercrimes).


The following are the duties of this position at the GS-14. If you are selected at a lower grade level, you will have the opportunity to learn to perform all these duties, and will receive training to help you grow in this position.
-Provide expert forensic support through the scientific analysis of electronic evidence. Conduct computer forensic examinations that are consistent with those standards established by TIGTA and the Department of Justice, as well as, reflective of current trends and techniques within the law enforcement and professional communities. This may include the testing and validation of forensic software and other appropriate automated analytical tools to meet diverse investigative requirements.
-Conduct, oversee, and coordinates investigations into extremely difficult, complex, highly technical, and sensitive matters of interregional and national dimensions, particularly as they relate to computer and computerized evidence. This includes solving violations of law relating to complex networking and communications, which may require law enforcement and/or civilian cooperation nationwide.
-Analyze and evaluate operational implications presented in proposed legislation and regulations, which impact on TIGTA investigative programs. Determine impact on law enforcement activities, both at the investigative and the prosecutive level. Develop options for proposing modifications to meet law enforcement requirements.
-Design and implement intrusion detection and analysis tools. Develop and use automated methods to recover evidentiary data from Microsoft, UNIX and other network-based systems penetrated by unauthorized parties.
-Develop new techniques, legal processes and approaches. Analyze, and review logs from a wide range of complex hardware and software from large-scale local area network and wide area network systems as it relates to illicit cyber activity, including protocols such as simple mail transfer protocol management systems, communications controllers, bridges, routers, firewalls, and other linked devices that support extensive network operations.

Travel Required

50% or less – 11 or more nights a month

Conditions of Employment

  • Please refer to “Conditions of Employment.”
  • Click “Print Preview” to review the entire announcement before applying.
  • Must be U.S. Citizens or U.S. Nationals.

The experience may have been gained in either the public, private sector or volunteer service. One year of experience refers to full-time work; part-time work is considered on a prorated basis. To ensure full credit for your work experience, please indicate dates of employment by month/day/year, and indicate number of hours worked per week on your resume.


You must meet the following requirements by the closing date of this announcement.

Age Restriction: The date immediately preceding an individual’s 37th birthday is the maximum entry age for original appointment to a law enforcement officer position. This requirement does not apply to a) Preference-eligible veterans; OR b) Individuals who are 37 years of age or older and have previously served in law enforcement officer positions that were covered by a special law enforcement retirement plan.

Medical Requirements: The duties of positions in this series require moderate to arduous physical exertion involving walking and standing, use of firearms, and exposure to inclement weather. Manual dexterity with comparatively free motion of finger, wrist, elbow, shoulder, hip, and knee joints is required. Arms, hands, legs, and feet must be sufficiently intact and functioning in order that applicants may perform the duties satisfactorily. Sufficiently good vision in each eye, with or without correction, is required to perform the duties satisfactorily. Near vision, corrective lenses permitted, must be sufficient to read printed material the size of typewritten characters. Hearing loss, as measured by an audiometer, must not exceed 35 decibels at 1000, 2000, and 3000 Hz levels. Since the duties of these positions are exacting and responsible, and involve activities under trying conditions, applicants must possess emotional and mental stability. Any physical condition that would cause the applicant to be a hazard to himself/herself, or others is disqualifying.

Specialized experience: For the GS-14, you must have one year of specialized experience at a level of difficulty and responsibility equivalent to the GS-13 grade level in the Federal service. Specialized experience for this position includes:

-Working in a rigorous law enforcement position that has provided the incumbent with experience in investigative techniques, statutes, legal rulings and jurisdictional issues to utilize in formulating policy, provide oversight and technical advice; AND
-Working on criminal and administrative cyber-based investigations (e.g. involving digital analysis of network activity, log analysis, dead-box forensics, and/or other electronic leads in the conduct of cyber investigations)

Specialized experience: For the GS-13, you must have one year of specialized experience at a level of difficulty and responsibility equivalent to the GS-12 grade level in the Federal service. Specialized experience for this position includes:

-Participating in the coordination of multi-agent cases or investigations that involve multiple subjects; AND
Performing criminal or administrative misconduct investigations involving law enforcement officers, or employees of all levels, including senior managers; AND
-Providing technical assistance, training, and consultation for criminal investigations, inspections and techniques, or coordinating criminal investigations and strategies; AND
-Utilizing various investigative techniques to establish interrelationships of facts or evidence; AND
-Investigating sensitive, controversial subjects or cases involving jurisdictional problems

In addition to the above requirements, you must meet the following time-in-grade requirement, if applicable:
For the GS-14, you must have been at the GS-13 level for 52 weeks.
For the GS-13, you must have been at the GS-12 level for 52 weeks.