Cybersecurity Operations Team Lead to support a large Department of War agency. You will lead a 24/7 cyber operations center responsible for monitoring, incident response, and forensics. You will maintain shift coverage, guide incident decisions, and improve response through consistent procedures and performance analysis. As the Cybersecurity Operations Team Lead, you will: * Lead a team responsible for 24/7 monitoring, incident response, and forensics. Serve as the escalation point for all shifts. Manage incident declaration, escalation, and timely reporting to USCYBERCOM and JFHQ-DODIN. Manage watch schedules, leave coverage, and staffing to maintain continuous operations. Lead shift briefings, handoffs, and operational reviews, and resolve recurring performance issues. Analyze triage, detection, and response metrics and implement measurable improvements. Approve automated response actions under the tiered approval model. Develop analysts for increased responsibility through mentoring and performance feedback.Minimum Requirements and Experience * 7+ years of experience, including 5+ in security analytics, incident response, threat analysis or security engineering. Bachelor's degree (4 additional years of experience may substitute). CISSP, and GCIH or GCIA. Active TS/SCI clearance; complete required tool training before system access.Required Knowledge and Skills * Running a 24/7 SOC: shift design, escalation, quality control and handoffs. DoD incident handling (CJCSM 6510.01B) and reporting timelines. Hands-on SIEM and EDR investigation experience sufficient to guide analysts through complex events. Calm decision-making during major incidents. Coaching analysts and building career paths.Preferred Qualifications * Prior experience leading a DoD 24/7 security operations center.
What you'll do
- Serve as the primary escalation authority across all shifts for a 24/7 SOC, making real-time incident declaration and triage decisions
- Manage and report cyber incidents to USCYBERCOM and JFHQ-DODIN in accordance with CJCSM 6510.01B timelines
- Own shift scheduling, leave coverage, and staffing continuity to sustain uninterrupted operations
- Lead shift briefings, handoffs, and after-action operational reviews; identify and resolve recurring analyst performance or process gaps
- Analyze SOC metrics (triage accuracy, detection latency, MTTR) and drive measurable improvements to response procedures
- Authorize automated response actions under the team's tiered approval framework
- Mentor analysts, build individual development plans, and prepare junior-to-mid analysts for expanded responsibilities
Mission
DoD 24/7 cyber operations center supporting a Department of Defense agency; mission includes continuous monitoring, incident response, forensics, and mandatory reporting to USCYBERCOM and JFHQ-DODIN
Required skills
- 24/7 SOC operations management
- Incident response and escalation
- SIEM investigation (hands-on)
- EDR investigation (hands-on)
- DoD incident handling (CJCSM 6510.01B)
- Threat analysis
- Shift management and staffing
- Analyst mentoring and performance development