Cybersecurity Cloud Ops Threat and Incident Response Lead

Booz Allen Hamilton • McLean, VA

7d

About The Position

Booz Allen is hiring a cybersecurity threat detection and incident response lead to operate and defend an AWS GovCloud platform and its agentic AI workloads, built to DoD Impact Level 5 requirements. The role owns detection and response, using tools such as Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable, and applying agentic AI to develop detections and automate triage, containment, and response. The lead works with platform, cyber, and governance teams to secure the production platform, assess changing risks, and make recommendations for implementation. Responsibilities include executing and improving incident response runbooks, responding within required reporting windows, serving on an on-call rotation, and producing continuous-monitoring evidence needed for authorization. The role supports defense missions and offers opportunities for mentoring, professional development, and certifications.

Requirements

• 3+ years of experience operating cloud security services in production, including AWS Security Hub, GuardDuty, Inspector, and CloudTrail.
• 3+ years of experience with a SIEM such as Splunk, including detection tuning and alert triage.
• Experience executing incident response runbooks and leading incident calls.
• Experience automating detection, triage, or response with scripting or AI-enabled tooling.
• Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements.
• Ability to work across cyber, platform, and governance teams in fast-moving mission environments.
• Secret clearance.
• Bachelor's degree in Cybersecurity, Computer Science, or Engineering and 5+ years of experience in security operations, incident response, or threat detection; alternatively, 9+ years of experience in those areas in lieu of a degree.

Nice To Haves

• Experience with AWS GovCloud or other IL4 or IL5 environments.
• Experience with Kubernetes (EKS) and container security monitoring.
• Experience with Tenable (ACAS), JFrog Xray, Trellix ePO, or Amazon Security Lake.
• Experience with agentic AI systems, LLM-enabled automation, or RAG/AI Factory platforms, including security monitoring of agent activity.
• Experience operating within structured SLAs, mission uptime requirements, and incident response MTTR and MTTA targets.
• Knowledge of pre-authorized automation and autonomy-level models for security operations.
• GCIH, GCIA, CISSP, Security+, or AWS Certified Security – Specialty certification.

Responsibilities

• Operate and defend an AWS GovCloud platform and its agentic AI workloads.
• Own threat detection and incident response for the platform.
• Use security monitoring tools including Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable.
• Develop detections and automate triage, containment, and response using agentic AI and other tooling.
• Execute and improve incident response runbooks, ensuring first action occurs within required reporting windows.
• Serve on the on-call rotation.
• Produce continuous-monitoring evidence required for the platform's authorization.
• Work with platform, cyber, and governance teams to secure the production platform, assess changing risks, and recommend improvements.

Benefits

• Health, life, and disability benefits.
• Financial and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior