Cybersecurity Operations Lead

Diné Development Corporation•Washington, DC

9h•$148,000 - $168,000

About The Position

The Cybersecurity Operations Lead directs cybersecurity monitoring, incident response, vulnerability remediation, and operational security reporting for DNFSB. This position is contingent upon contract award. The role oversees security event monitoring and analysis, incident handling, vulnerability remediation coordination, insider threat monitoring, privileged access oversight, and endpoint and cloud security response. It also maintains operational security documentation and evidence, supports CDM dashboards and authorization evidence, coordinates POA&M tracking and reporting, and briefs the Project Manager and agency security leadership. The position requires a bachelor’s degree, at least eight years of relevant cybersecurity experience—including at least five years supporting federal cybersecurity programs—and CISSP or equivalent certification. U.S. citizenship and favorable Tier 2 Public Trust adjudication are required before performance. The stated salary range is $148,000 to $168,000. The role is contingent on contract award.

Requirements

Bachelor’s degree.
At least 8 years of relevant cybersecurity experience, including cybersecurity operations, incident response, or Security Operations Center (SOC) environments.
At least 5 years supporting federal cybersecurity programs.
U.S. citizenship.
Favorable Tier 2 Public Trust adjudication required before performance.
CISSP or equivalent certification.
Relevant qualifications in SIEM and log analysis, incident response, vulnerabilities, FISMA/FedRAMP, Zero Trust, and cross-functional cyber coverage.

Nice To Haves

Security Operations Analyst Associate certification or GCIH certification.

Responsibilities

Lead monitoring and analysis of security events, logs, and alerts using Microsoft Sentinel, Defender, Qualys, and other agency security tools.
Direct incident triage, investigation, escalation, containment, and recovery coordination; maintain documented response procedures and incident records.
Track incident response measures: triage within 15 minutes, response within two hours, and containment within four hours during required business hours.
Analyze vulnerabilities, prioritize remediation with infrastructure owners, validate mitigations, and track unresolved security risks.
Coordinate insider threat monitoring, privileged access oversight, and endpoint and cloud security response with the Microsoft 365 specialist.
Maintain operational security inputs for CDM dashboards and authorization evidence; work with the risk analyst on POA&M status and mitigation records.
Prepare monthly threat reports, coordinate monthly POA&M updates and quarterly CDM integration status reporting, and brief the Project Manager and agency security leadership.
Provide qualified backup coverage across cybersecurity functions and maintain operational documentation and knowledge transfer.