Cybersecurity Cloud Ops Threat and Incident Response Lead
About The Position
As the threat detection and incident response lead, you will operate and defend an AWS GovCloud platform and its agentic AI workloads, built to DoD Impact Level 5 (IL5) requirements. You will use tools including Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable, alongside agentic AI, to build detections and automate triage, containment, and response. You will work with platform, cybersecurity, and governance teams to maintain production security, evaluate changing risks, and recommend improvements. You will own detection and response on the platform, execute and improve incident response runbooks so initial actions meet required reporting windows, serve on the on-call rotation, and produce continuous monitoring evidence needed for authorization. The position is hybrid and based in McLean, Virginia. Booz Allen also describes opportunities for mentoring, certifications, and professional growth.
Requirements
- At least 3 years of experience operating cloud security services in production, including AWS Security Hub, GuardDuty, Inspector, and CloudTrail.
- At least 3 years of experience with a SIEM such as Splunk, including detection tuning and alert triage.
- Experience executing incident response runbooks and leading incident calls.
- Experience automating detection, triage, or response with scripting or AI-enabled tooling.
- Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements.
- Ability to work across cybersecurity, platform, and governance teams in fast-moving mission environments.
- Secret clearance.
- Bachelor's degree in Cybersecurity, Computer Science, or Engineering and at least 5 years of experience in security operations, incident response, or threat detection; alternatively, at least 9 years of such experience in lieu of a degree.
Nice To Haves
- Experience with AWS GovCloud or other IL4 or IL5 environments.
- Experience with Kubernetes (EKS) and container security monitoring.
- Experience with Tenable (ACAS), JFrog Xray, Trellix ePO, or Amazon Security Lake.
- Experience with agentic AI systems or LLM-enabled automation, including security monitoring of agent activity.
- Experience operating within structured SLAs, uptime or mission uptime requirements, and incident response MTTR and MTTA targets.
- Experience with RAG or AI Factory platforms, including security monitoring of agent activity.
- Knowledge of pre-authorized automation and autonomy-level models for security operations.
- GCIH, GCIA, CISSP, Security+, or AWS Certified Security – Specialty certification.
Responsibilities
- Operate and defend an AWS GovCloud platform and its agentic AI workloads.
- Use Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable to support threat detection and response.
- Build detections and automate triage, containment, and response using agentic AI and other tools.
- Collaborate with platform, cybersecurity, and governance teams to maintain production security and evaluate changing risks.
- Own detection and response for the platform.
- Execute and improve incident response runbooks so first action occurs within the required reporting window.
- Serve on the on-call rotation.
- Produce continuous monitoring evidence required for authorization.
- Lead incident calls and execute incident response runbooks.
Benefits
- Health, life, and disability benefits
- Financial and retirement benefits
- Paid leave
- Professional development
- Tuition assistance
- Work-life programs
- Dependent care
- Recognition awards program
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
