Cyber Defense Operator

Viranim Technical Solutions•San Antonio, TX

About The Position

The Cyber Defense Operator provides mission-critical support to the Air Force Cyber Emergency Response Team (AFCERT) by executing Defensive Cyberspace Operations (DCO) to defend United States Air Force networks and supported Combatant Commands. The role protects Air Force information systems by identifying, analyzing, and mitigating cyber threats in near real time. AFCERT operates in a high-tempo, 24/7/365 environment with zero tolerance for error, requiring exceptional attention to detail, precision, and responsiveness. Operators support cyberspace defense capabilities that protect and defend Air Force Networks (AFNet), detect and respond to threats and intrusions, ensure mission assurance, and conduct network defense operations across NIPRNet and SIPRNet. Depending on mission needs, operators may support network detection and monitoring, incident response and forensics, signature management, weapons and tactics development, content development, training and curriculum development, host-based detection, operational processes and PEX management, or continuity of operations.

Requirements

Active Top Secret clearance with SCI eligibility.
GCFA certification.
Experience in cyber defense, network security, or Security Operations Center (SOC) environments.
Working knowledge of IDS/IPS systems, SIEM platforms, network protocols, and traffic analysis.
Strong analytical, problem-solving, and decision-making skills.
Ability to operate effectively in a high-tempo, mission-critical environment.

Nice To Haves

Familiarity with DoD cyber operations.
Experience supporting Air Force network environments.

Responsibilities

Plan, implement, and execute AFCERT-directed defensive cyberspace operations.
Continuously monitor and analyze network traffic, alerts, and events; operate and analyze IDS and IPS systems; detect and mitigate malicious or anomalous activity; and conduct incident response, containment, and remediation.
Monitor security events across Air Force systems in near real time and review IDS/IPS alerts, SIEM data, and system logs.
Correlate network activity with intelligence sources and conduct initial assessments of intrusions, including scope, impact, and threat type.
Triage alerts, determine appropriate response actions, isolate and mitigate threats, execute approved actions across systems, endpoints, and network components, and escalate incidents according to established procedures.
Document incidents accurately, maintain case records in mission systems, generate Mission Reports (MISREPs), deliver shift turnover briefings, and track and report performance metrics.
Analyze threat intelligence and map adversary activity to frameworks such as MITRE ATT&CK; provide feedback to improve detection accuracy and reduce false positives.
Provide on-the-job training to team members, maintain continuity documentation and operational aids, develop and refine tactics, techniques, and procedures, and recommend improvements to processes, tools, and systems.
Support mission leads and crew commanders with execution and prioritization; participate in mission planning, briefings, and debriefings; maintain situational awareness and report anomalies affecting mission readiness.
Conduct periodic physical security checks of operational areas, initiate emergency procedures when required, and report facility or operational anomalies to leadership.
Support one or more functional areas, including network detection and monitoring, incident response and forensics, signature management, weapons and tactics development, content development, training and curriculum development, host-based detection, operational processes and PEX management, and continuity of operations.