15+ years of cybersecurity experience, particularly in security operations or incident response.
Proven ability to tackle complex technical problems through deep analysis and collaboration.
Experience leading technical teams in a large enterprise environment.
Strong communication skills for conveying technical risks to senior stakeholders.
Track record of mentoring technical staff and enhancing team capabilities.
Responsibilities
Coordinate daily security operations across various functions including incident response and threat intelligence.
Act as the technical escalation point for high-impact incidents and service disruptions.
Review incidents for scope, severity, and operational impact, providing recommended actions.
Guide containment and recovery efforts in collaboration with various stakeholders.
Track operational risks and unresolved issues, ensuring corrective actions are taken.
Prepare and present operational updates and risk summaries to diverse audiences.
Lead knowledge-transfer and operational-readiness activities during transitions.
Benefits
Hybrid work environment with a mix of onsite and remote work.
Opportunities for professional development and mentoring.
Engagement in high-impact cybersecurity operations.
Involvement in complex incident response and operational transitions.
Full Job Description
Technical Lead - Cybersecurity Operations
Position Overview
The Technical Lead provides hands-on technical leadership for a large, mission-focused security operations environment. This position coordinates day-to-day technical execution, guides complex incident analysis and response, manages technical escalations, supports service continuity, and communicates operational status and risk to program and customer leadership. This is not a purely advisory or management role; the successful candidate must move effectively between executive communication, detailed technical review, operational decision support, and workforce mentoring.
Duties & Responsibilities
Coordinate daily security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform-support functions.
Serve as the technical escalation point for complex, sensitive, or high-impact incidents and service disruptions.
Guide containment, eradication, recovery, and post-incident improvement activities in coordination with system, network, identity, cloud, and security stakeholders.
Track operational risks, technical dependencies, staffing-coverage concerns, service impacts, unresolved issues, and corrective actions.
Prepare and present clear operational updates, technical briefings, risk summaries, and decision recommendations for diverse audiences.
Lead transition, knowledge-transfer, continuity, and operational-readiness activities that preserve critical security functions during change or disruption.
Maintain and improve operating procedures, escalation paths, contact information, response playbooks, and technical knowledge content.
Mentor analysts, engineers, administrators, and technical leads; establish consistent technical-review and quality expectations.
Identify recurring operational problems and sponsor practical improvements to tools, workflows, detection, response, documentation, and communication.
Qualifications
Minimum Requirements:
Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
Demonstrated ability to resolve undefined, highly complex, multidimensional technical problems requiring deep analysis and cross-functional collaboration.
Experience leading technical teams and coordinating high-priority operational work in a large enterprise environment.
Strong written and verbal communication skills, including the ability to explain technical risk and response options to senior stakeholders.
Demonstrated record of mentoring technical staff and improving team capability.
Preferred Qualifications:
Experience leading or serving as deputy technical lead for a large federal SOC, incident response center, or comparable enterprise security-operations program.
Experience in hybrid on-premises and cloud environments, including AWS, Azure, or Microsoft 365.
Experience supporting continuity exercises, major incident response, or large operational transitions.
CISSP and GCIH preferred; GCFA, GREM, GCIA, GNFA, CISM, or PMP are also valuable.
Working knowledge of widely used incident-response, security-control, and federal cybersecurity guidance.
What Success Looks Like
Operational issues and technical risks are identified early, assigned clear ownership, and driven to evidence-based closure.
Technical teams work from current procedures, understand escalation paths, and maintain effective handoffs and backup coverage.
Program and customer leaders receive concise, decision-ready information about service health, risk, and required action.
Education and Certifications:
Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.
Clearance Level:
Active Top Secret clearance strongly preferred.
Work Location
Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.
Hours of Operation
Core business hours with availability for after-hours escalation, on-call support, exercises, and continuity events.
Ability to pass a minimum background investigation.
