Cybersecurity Cloud Ops Threat and Incident Response Lead

Booz Allen Hamilton•McLean, VA

8d•$86,800 - $198,000

About The Position

The Cybersecurity Cloud Ops Threat and Incident Response Lead operates and defends an AWS GovCloud platform built to DoD Impact Level 5 requirements, along with the agentic AI workloads running on it. The role owns threat detection and incident response, using tools including Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable. It also applies agentic AI to develop detections and automate triage, containment, and response, turning recurring incidents into automated platform solutions. Working with platform, cyber, and governance teams, the lead secures the production platform, evaluates changing risks, and makes recommendations for implementation. The role executes and improves incident response runbooks so first action occurs within required reporting windows, participates in the on-call rotation, and produces continuous monitoring evidence needed for authorization.

Requirements

At least 3 years of experience operating cloud security services in production, including AWS Security Hub, GuardDuty, Inspector, and CloudTrail.
At least 3 years of experience with a SIEM such as Splunk, including detection tuning and alert triage.
Experience executing incident response runbooks and leading incident calls.
Experience automating detection, triage, or response with scripting or AI-enabled tooling.
Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements.
Ability to work across cyber, platform, and governance teams in fast-moving mission environments.
Secret clearance.
Bachelor's degree in Cybersecurity, Computer Science, or Engineering and at least 5 years of experience in security operations, incident response, or threat detection; alternatively, at least 9 years of experience in those areas in lieu of a degree.

Nice To Haves

Experience with AWS GovCloud or other IL4 or IL5 environments.
Experience with Kubernetes (EKS) and container security monitoring.
Experience with Tenable (ACAS), JFrog Xray, Trellix ePO, or Amazon Security Lake.
Experience with agentic AI systems or LLM-enabled automation, including security monitoring of agent activity.
Experience operating within structured SLAs, mission uptime requirements, and incident response MTTR and MTTA targets.
Experience with RAG/AI Factory platforms, including security monitoring of agent activity.
Knowledge of pre-authorized automation and autonomy-level models for security operations.
GCIH, GCIA, CISSP, Security+, or AWS Certified Security – Specialty certification.

Responsibilities

Operate and defend an AWS GovCloud platform and its agentic AI workloads.
Own threat detection and incident response for the platform.
Use security tools including Splunk, AWS Security Hub, GuardDuty, Inspector, and Tenable to detect and investigate threats.
Build detections and automate triage, containment, and response using agentic AI and other automation.
Execute and improve incident response runbooks, ensuring first action occurs within required reporting windows.
Lead incident calls and participate in the on-call rotation.
Work with platform, cyber, and governance teams to secure the production platform and assess changing risks.
Make security recommendations for implementation.
Produce continuous monitoring evidence required for authorization.