About the Role:

The Technical Specialist, Threat Operations serves as a senior operational leader and key partner within the Cyber Operations team, acting as the functional second-in-command across threat operations activities. This role is responsible for building, scaling, and sustaining a comprehensive threat operations program that translates threat and exposure signals into actionable insights and business risk decisions.

This position combines hands-on operational oversight• including detection, triage, investigation, and response• with ownership of strategic program elements such as threat intelligence, lifecycle governance, and Continuous Threat Exposure Management (CTEM). The role also requires leadership through influence, driving consistent execution, talent development, and high-quality outcomes across analysts, partners, and stakeholders.

The Technical Specialist, Threat Operations is expected to maximize AI-assisted and agentic AI workflows while maintaining human accountability, secure data handling, and audit-ready evidence. All outputs must remain defensible, traceable, and aligned with enterprise governance standards.

Currently, this is a remote-first position, and this position may be required to periodically work on-site at our office and the frequency would depend on the department/division's requirements. Therefore, candidates must either reside within a reasonable distance to commute to our office or be willing to travel to our office in Herndon, when required.
How You Contribute:

• Demonstrate the Clearinghouse's core competencies: Customer Focus, Optimizes Work Processes, Collaborates, Communicates Effectively, and Be Open and Authentic.
• Oversee detection, triage, and validation of security alerts, ensuring timely and evidence-based disposition.
• Translate technical findings into clear risk-based recommendations and actionable next steps.
• Serve as escalation lead during high-severity incidents, ensuring proper scoping, documentation, and remediation to closure.
• Develop and mature the threat operations program roadmap, including CTEM strategy and operating model.
• Perform business-centric threat modeling to align adversary activity with enterprise risk and impact.
• Define governance frameworks, including prioritization logic, escalation criteria, and executive reporting.
• Design and continuously improve repeatable workflows, including AI-assisted triage, investigation, and reporting processes.
• Establish and manage key performance indicators (e.g., MTTD, MTTR, detection quality, noise reduction).
• Maintain playbooks, investigation templates, and escalation workflows to ensure consistency and audit readiness.
• Drive continuous improvement of detection fidelity through tuning and feedback loops.
• Implement AI-assisted workflows with clear human-in-the-loop validation and decision points.
• Ensure secure handling of sensitive data and alignment with enterprise AI governance policies.
• Validate AI outputs for accuracy and reliability and mitigate known risks such as hallucinations, bias, or incomplete context.
• Harden AI processes against adversarial threats (e.g., prompt injection, data leakage).
• Lead the threat intelligence lifecycle, including requirements, collection, analysis, dissemination, and feedback.
• Translate intelligence into actionable outputs such as threat hunts, detection priorities, and control validation.
• Deliver executive-ready threat assessments with clear sourcing and confidence levels.
• Establish operating rhythms and performance expectations with external security partners.
• Ensure alignment with MITRE ATT&CK coverage and measurable detection and response outcomes.
• Integrate partner outputs into internal workflows, ensuring accountability and closure of findings.
• Lead investigations involving cloud control plane threats (such as AWS and OCI), focusing on identity and configuration risks.
• Correlate cloud, endpoint, identity, and network signals to prioritize remediation based on risk.
• Partner with engineering teams to validate remediation and risk acceptance actions and decisions.
• Coordinate with incident response, engineering, and business stakeholders to drive remediation.
• Integrate third-party risk insights into threat analysis and recommendations.
• Partner with architecture and assurance teams to improve long-term security controls.

Position may be required to perform other duties as required. These essential functions are representative of those that must be met by an employee to successfully perform the job. Reasonable accommodations will be made to enable individuals with disabilities to perform these essential functions.
What You Bring to the Table:

• Bachelors degree in Cybersecurity, Computer Science, IT, or any related field. A combination of education and experience including military service will also be considered.
• Current, active certification in one or more of the following is required: CISSP, CISM, GIAC, CySA+, Microsoft Security, or cloud security certifications.
• 10 years of direct experience in cybersecurity operations, incident response, or threat analysis.
• Experience investigating cloud security issues (AWS and/or OCI).
• Hands-on experience with AI-assisted security workflows and governance-aligned practices.
• Experience developing threat intelligence or CTEM-aligned programs.
• Experience managing external security partners and service delivery (e.g., MDR/MSSP), including performance outcomes, SLAs, and continuous improvement.
• Strong knowledge of threat operations, incident response, and investigation methodologies.
• Advanced understanding of MITRE ATT&CK framework and detection coverage strategies.
• Knowledge of cloud security threats (AWS, OCI), particularly identity and control plane risks.
• Understanding of threat intelligence lifecycle and CTEM program implementation.
• Knowledge of enterprise AI governance, including generative AI risks and controls.
• Ability to build and scale threat operations processes and programs.
• Ability to develop metrics and reporting frameworks that drive decision-making.
• Experience designing AI-assisted investigation and triage workflows.
• Ability to translate technical risk into business-aligned remediation strategies.
• Strong decision-making skills under uncertainty, supported by defensible evidence.
• Excellent communication skills with both technical and executive audiences.
• High degree of judgment, integrity, and accountability.
• Ability to collaborate cross-functionally and influence without direct authority.
• Demonstrated leadership through influence across matrixed teams, partners, and stakeholders, including prioritization, coaching, performance feedback, and operational execution.
• Exceptional ability to translate and communicate technical risk, threat assessments, and mitigation strategies to technical, executive, and board-level audiences.
• Demonstrates the Clearinghouse's core competencies: customer focus, optimizes work processes, communicates effectively, collaborates, and is open and authentic.
• Must live within a commutable distance to Herndon, VA or in one of the Clearinghouse's approved States for hiring purposes. Refer to our HR Policies Page, located on our Careers site at https://www.studentclearinghouse.org/careers/human-resource-policies/ , for more details.
• Must be currently authorized to work in the United States on a full-time basis. We do not intend to sponsor external applicants for work visas, and may consider sponsorship only if no qualified candidates can be found who are authorized to work without sponsorship.
• Must be at least 18 years old.

Additional Desired Qualifications

• Experience building or maturing CTEM programs.
• Experience managing MDR/MSSP vendors using outcomes-based metrics.
• Scripting or query language experience (e.g., Python, PowerShell, KQL).
• Experience presenting to senior leadership or board-level audiences.
• Experience with SOAR automation and AI-assisted investigation workflows.
• Experience with enterprise Copilot tools and governed AI environments.
• Knowledge of security tools such as Microsoft Defender, Wiz Defend, etc.
• Experience implementing QA and validation processes for AI outputs.
• Prior experience managing direct reports within a cybersecurity, threat intel, or technical environment

Physical Demands:

• Use of a computer for 8 or more hours a day.
• Use of a telephone and/or copy machine.
• Frequently required to sit for 7 or more hours per day.
• Occasionally required to use hands and fingers to operate, handle, and reach.
• Vision abilities include close vision and the ability to adjust focus.

Benefits and Related Information

The National Student Clearinghouse provides a robust benefit program designed to help meet the needs of each employee and their family, both now and in the future. We offer comprehensive medical, dental, and vision insurance, as well as life and disability insurance benefits, for employees and their qualified dependents. Health care, dependent care, and limited purpose flexible spending accounts, as well as a health savings account with annual employer contributions of $300 for employees and $600 for employees who are enrolled with their spouse and/or dependents, voluntary supplemental health plans for Accident and Hospital Indemnity coverage, and infertility coverage are options available for employees to set aside pre-taxed dollars for certain qualifying expenses. We offer a very generous 401k matching contribution program with the opportunity to defer pre-tax and Roth contributions, as well as catch-up contributions for those who are eligible! We are proud to offer a competitive paid leave program consisting of vacation, sick, and personal time, as well as paid holidays, up to 3 weeks of paid parental leave during a 12-month period , and up to 5 days of paid military leave per calendar year . Vacation time will accrue based on length of service, and new full-time hires can accrue up to 13 days of vacation and up to 10 days of sick time per year. On an annual basis, new employees may use up to 32 hours of accrued sick time as personal time. Additionally, the Clearinghouse observes at least 15 paid holidays per year, including company year-end close between Christmas and New Years Holidays.

Another perk is that employees have the option to get reimbursed for basic wholesale company and roadside assistance memberships (e.g., Costco and AAA) and to request a buy back on portions of unused accrued vacation based on tenure and certain other qualifications. Employees can further their education and professional development by using our Employee Education Assistance Program, which establishes reimbursement for qualified education expenses upon successful completion of the program, and leveraging the enterprise-wide LinkedIn Learning subscription. There are additional employee benefits too, including but not limited to, mental health with up to eight free therapy sessions for employees and their family members and well-being reward benefits. With the Clearinghouse being an eligible 501(3)(c) nonprofit organization, employees are eligible for service credit towards the Public Service Loan Forgiveness program (PSLF). To find out more, please request a copy of our Benefits at a Glance!

Additionally, we reasonably believe that the salary range for this position is between $175,000 and $212,000.

The pay range listed above represents a good faith estimate and is not a guarantee of compensation or salary. The National Student Clearinghouse considers multiple factors when determining base pay for offers, including but not limited to the responsibilities and scope of the role, as well as a candidate's experience, education, knowledge, skills, abilities, internal equity, and alignment with market data.

Internal Candidates: If you feel you meet the qualifications for the role, we strongly encourage you to apply and focus on preparing for the application process. Finalist internal candidates will receive a compensation review prior to any offer being made. In accordance with the Clearinghouse's compensation and promotion guidelines, internal compensation practices will be applied first, which may result in pay that differs from the posted salary range.

This job announcement was posted to the National Student Clearinghouse's Careers site at www.studentclearinghouse.org/careers on 8/18/2026 and the online application period will be open for at least 3 days from this posting date. A completed online application is required to be considered for this opportunity.