Type of Requisition:
Regular

Clearance Level Must Currently Possess:
Interim Secret

Clearance Level Must Be Able to Obtain:
Top Secret/SCI

Public Trust/Other Required:
None

Job Family:
Cyber and IT Risk Management

Job Qualifications:

Skills:
Cyber Operations, Incident Management, Operational Reporting
Certifications:
None
Experience:
10 + years of related experience
US Citizenship Required:
Yes

Job Description:

Watch Officer (Shift Lead)
Position Summary
The Watch Officer serves as the senior authority on the watch floor for an assigned shift in a 24x7x365 cyber command center supporting national cyber defense across Critical Infrastructure, SLTT, and Federal Civilian partners. This role directs monitoring, triage, escalation, and coordination activities throughout the shift and is accountable for maintaining an accurate operational picture for turnover. The Watch Officer determines escalation thresholds, approves actions within established authorities, guides analysts, and acts as the first response when operational tempo increases.

Key Responsibilities

Shift Command & Floor Authority

• Lead watch-floor operations and direct analyst activity.
• Maintain the operational picture of active watch items, incidents, and escalations.
• Exercise approval authority within defined thresholds and identify when higher-level approval is required.
• Make timely escalation decisions based on established criteria.
• Ensure tools, systems, and displays support real-time decision making.

Review of Analytic Output

• Review assessments and recommended actions before presentation to leadership.
• Hold or return products that do not meet standards.
• Distinguish between immediate operational needs and items requiring longer-term analysis.

Incident Triage, Escalation & Coordination

• Direct initial triage and ensure response actions begin within required timelines.
• Determine escalation pathways for incidents involving Critical Infrastructure, SLTT, and Federal partners.
• Identify appropriate authorities for recommended actions and distinguish those executable on shift from those requiring external approval.
• Coordinate with federal law enforcement, National Guard, state response teams, and reachback support.
• Ensure incident records are complete, accurate, and properly scored using NCISS.

Situational Awareness & Reporting

• Maintain shared situational awareness across the floor and with mission partners.
• Oversee shift contributions to daily, weekly, and monthly reporting.
• Ensure decisions are documented with rationale and aligned to required formats and timelines.

Shift Turnover & Battle Rhythm

• Execute structured shift turnover with a complete and accurate picture of open incidents and outstanding actions.
• Maintain reporting cycles, required checks, and coordination points.
• Document shift activity for continuity, review, and compliance.
• Apply classification requirements and identify content requiring downgrade requests.

Team Direction, Training & Readiness

• Guide analysts through tasking, feedback, and on-the-job development.
• Ensure personnel maintain required certifications and training.
• Support onboarding and qualification of new analysts.

Surge & Crisis Response

• Coordinate expanded coverage during elevated operational tempo.
• Support crisis action teams and ensure sustained response capability.
• Maintain readiness to extend or backfill coverage during surge periods.

Required Qualifications

• Experience as a watch officer or shift lead in a 24x7 SOC, fusion center, or incident command environment.
• Strong knowledge of incident triage, escalation, and lifecycle management.
• Proven ability to make time-sensitive operational decisions under pressure.
• Experience exercising operational approval authority.
• Experience with shift turnover and operational reporting.
• Familiarity with NCISS or similar incident scoring frameworks.
• Bachelor's degree and 10+ years of cybersecurity experience, including team leadership.
• Active Top Secret clearance.

Preferred Qualifications

• Experience supporting national-level cyber operations centers.
• Experience establishing or maturing watch-floor processes.
• Experience reviewing analytic or tooling output prior to leadership consumption.
• Experience coordinating with federal, SLTT, and private-sector partners during incidents.
• Awareness of ICS/OT environments.
• Certifications such as CISSP, GCIH, GCIA, GCTI, or similar.

The likely salary range for this position is $153,000 - $207,000. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Scheduled Weekly Hours:
40

Travel Required:
Less than 10%

Telecommuting Options:
Hybrid

Work Location:
USA VA Arlington

Additional Work Locations:

Total Rewards at GDIT:
Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.

Our Identity Verification Process:
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.