Defensive Cyber Ops Lead

Nightwing Intelligence Solutions • Sterling, VA

23h • $147,000 - $296,000

About The Position

Nightwing is seeking a senior-level technical authority to lead defensive cyber operations and manage daily cyber defense tasking, operational tempo, and personnel readiness. The role serves as the primary liaison between contractor personnel and mission counterparts, translating operational requirements into defensive cyber missions and aligning staff skills and certifications with mission priorities. It supports critical Intelligence Community missions across accredited environments and systems with Authority to Operate (ATO), maintaining compliance with DoD Information Assurance requirements and operational security standards.

The Lead oversees threat detection, threat hunting, incident response, continuous monitoring, SOC activities, and defensive cyber technologies in dynamic threat environments. The position supports large-scale programs with 50+ FTEs and annual portfolio value of $50M+, operating in 24/7/365 mission settings. It includes coordinating across military, intelligence, contractor, SOC, NOC, and engineering teams; reporting operational status and performance to senior government and company leadership; and developing team capabilities, training, and operational procedures. The role also manages operational risks and mission assurance during incidents, outages, high-threat periods, and personnel transitions.

Nightwing describes the work as supporting national security and Intelligence Community operations through cyber defense, data operations, systems integration, and intelligence mission support. The company offers competitive compensation with performance-based incentives and medical, vision, dental, 401(k), PTO, holidays, and additional insurance coverage.

Requirements

• Bachelor's or Master's degree in Computer Science, Cybersecurity, IT, or a related STEM field.
• Security+ certification and at least one of CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification.
• One of the following defensive cyber leadership experience options: 10+ years of cybersecurity operations experience with demonstrated leadership of defensive cyber teams; 8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs and $50M+ budgets); or 10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions.
• One of the following domain experience options: 5–8 years of cybersecurity, SOC, or cyber incident response experience with operational focus; 5–8 years of detection engineering and automation experience; or 5–8 years of cyber operations or threat hunting with Intelligence Community customers.
• Deep understanding of defensive cyber operations, threat detection methodologies, and incident response processes.
• Demonstrated experience with programs of similar size and scope supporting Intelligence Community missions.
• Extensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior, including nation-state and APT groups.
• Strong understanding of SOC operations, shift management, and operational battle rhythm in 24/7/365 environments.
• Experience with SIEM platforms such as Splunk, Elastic, or Sentinel; EDR/XDR tools; and defensive cyber technologies.
• Working knowledge of threat intelligence platforms, threat hunting methodologies, and the MITRE ATT&CK framework.
• Familiarity with network security monitoring, log analysis, and forensic investigation techniques.
• Understanding of Cyber Operations and partner cyber mission teams.
• Exceptional operational leadership, including the ability to lead teams under high-pressure, high-tempo conditions and make rapid operational decisions.
• Track record of building and maintaining high-performing cyber defense teams, with strong retention and morale.
• Ability to brief senior military and civilian leadership during incidents.
• Experience managing in military or Intelligence Community operational environments with complex reporting structures.
• Proven ability to coordinate across military, intelligence, and contractor organizations.

Nice To Haves

• Experience within Intelligence Community and cyber mission partner environments.
• Advanced GIAC certifications such as GCIH, GCIA, GCFA, GNFA, or GREM, or equivalent advanced certifications.
• Multiple advanced certifications, such as CISSP, CISM, GCTI, CEH, or offensive security certifications.
• Experience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missions.
• Background in threat intelligence analysis, malware reverse engineering, or advanced threat hunting.
• Experience with cloud security operations (AWS, Azure, or GCP) and hybrid network defense.
• Prior experience managing 24/7/365 SOC operations with multi-tiered support structures.
• Experience supporting classified programs at TS/SCI level with special access programs (SAP).
• Track record of operational innovation that improved detection, response, or threat hunting capabilities.

Responsibilities

• Serve as senior operational authority for defensive cyber operations across the program portfolio.
• Manage daily cyber defense tasking and operational battle rhythm for 24/7/365 Intelligence Community operations.
• Act as the primary liaison between contractor personnel and military counterparts, and coordinate with mission partners and stakeholders.
• Lead threat detection, incident response, threat hunting, intrusion detection, malware analysis, and network defense operations.
• Direct Security Operations Center activities, continuous monitoring, and rapid-response capabilities.
• Make tactical and operational decisions during cyber incidents and defensive operations.
• Match personnel skills and certifications to operational requirements; maintain a skills matrix and track readiness across 50+ operators.
• Coordinate personnel scheduling and duty assignments across multiple shifts and mission sets.
• Conduct operational readiness assessments and capability gap analyses; support technical hiring, training, and professional development.
• Provide situational awareness, operational status updates, threat briefings, and executive-level reporting to program leadership, customers, and senior government leadership.
• Support planning and execution of defensive cyber operations, coordinated hunts, and incident response.
• Coordinate with Network Operations Centers, SOCs, Cyber Operations Centers, and engineering teams across the enterprise.
• Track and report operational metrics, including detection rates, MTTD, MTTR, threat containment effectiveness, and SLA compliance.
• Analyze threat intelligence and operational trends, and implement proactive defensive measures.
• Support after-action reviews and lessons-learned processes; maintain SOPs, playbooks, run books, and operational documentation.
• Assess and develop team capabilities; recommend certifications, technical training, and operational exercises.
• Integrate new tools, techniques, and procedures into defensive operations and lead training and tabletop exercises.
• Oversee SIEM platforms, EDR/XDR solutions, and defensive cyber tools; support tuning of detection content, correlation rules, and alert workflows.
• Maintain awareness of network architecture, critical assets, and defensive coverage; support continuous monitoring and IA compliance for accredited systems.
• Identify, assess, and mitigate operational risks; develop tactical response procedures and escalation protocols.
• Ensure operational continuity during high-threat periods, system outages, personnel transitions, and major incidents while balancing operational tempo with team well-being.

Benefits

• Medical insurance
• Vision insurance
• Dental insurance
• 401(k) plan
• PTO
• Holidays
• Additional insurances
• Performance-based incentives tied to operational performance and SLA achievement

What This Job Offers

• Job Type: Full-time
• Career Level: Senior