Defensive Cyber Ops Lead

Nightwing•Sterling, VA

2d•$147,000 - $296,000•Onsite

About The Position

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets. We are seeking an exceptional Defensive Cyber Operations Lead to manage daily cyber defense tasking and operational tempo, serving as the primary liaison between contractor personnel and mission counterparts to ensure seamless coordination and mission alignment. This role requires a proven senior-level technical authority who can match personnel skills and certifications to operational requirements and mission priorities while managing complex, large-scale operations supporting critical national security missions. Nightwing delivers end-to-end secure IT services leveraging deep experience in Offensive Cyber Operations (OCO), Defensive Cyber Operations (DCO), Cyber Vulnerability Assessments (CVAs), and systems integration. As Defensive Cyber Operations Lead, you will translate operational requirements into actionable defensive cyber missions, lead threat detection and response operations, and ensure our cyber defense capabilities remain operationally effective in dynamic threat environments. You will be responsible for maintaining operational readiness of cyber defense teams operating within accredited environments, ensuring compliance with DoD Information Assurance (IA) requirements, and supporting defensive cyber operations across systems with Authority to Operate (ATO). This includes leading threat hunting activities, incident response operations, and continuous monitoring that meet operational security standards and mission requirements. This is a high-visibility, operationally critical leadership position requiring an individual who can lead cyber defense teams supporting programs with 50+ FTEs, navigate 24/7/365 operational environments in mission settings, and drive organizational success through operational excellence, mission-focused leadership, and tactical proficiency. You will be accountable for the operational readiness and defensive posture of teams supporting critical Intelligence Community operations.

Requirements

Bachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM field
Security+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification
10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams
8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)
10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions
5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus
5-8 years detection engineering and automation experience
5-8 years cyber operations or threat hunting with Intelligence Community customers
Deep understanding of defensive cyber operations, threat detection methodologies, and incident response processes
Demonstrated experience with programs of similar size and scope supporting Intelligence Community missions
Extensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groups
Strong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environments
Experience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologies
Working knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK framework
Familiarity with network security monitoring, log analysis, and forensic investigation techniques
Understanding of Cyber Operations and partner cyber mission teams
Exceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditions
Demonstrated success in mission environments requiring rapid operational decision-making and tactical leadership
Track record of building and maintaining high-performing cyber defense teams with strong retention and morale
Strong operational presence with ability to brief senior military and civilian leadership during incidents
Experience managing in military or intelligence community operational environments with complex reporting structures
Proven ability to coordinate across organizational boundaries including military, intelligence, and contractor teams

Nice To Haves

Experience within Intelligence Community and Cyber mission partner environments
Advanced GIAC certifications: GCIH, GCIA, GCFA, GNFA, GREM, or equivalent advanced certifications
Multiple advanced certifications: CISSP, CISM, GCTI, CEH, or offensive security certifications
Experience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missions
Background in threat intelligence analysis, malware reverse engineering, or advanced threat hunting
Experience with cloud security operations (AWS, Azure, GCP) and hybrid network defense
Prior experience managing 24/7/365 SOC operations with multi-tiered support structures
Experience supporting classified programs at TS/SCI level with special access programs (SAP)
Track record of operational innovation improving detection, response, or threat hunting capabilities

Responsibilities

Serve as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annually
Manage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operations
Serve as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignment
Lead threat detection, incident response, and threat hunting operations across enterprise-scale networks
Oversee cyber defense missions including intrusion detection, malware analysis, and network defense operations
Direct Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilities
Drive tactical and operational decisions during cyber incidents and defensive operations
Match personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operators
Maintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levels
Ensure team maintains readiness to support dynamic threat environments and surge requirements with minimal notice
Coordinate personnel scheduling and duty assignments across multiple operational shifts and mission sets
Conduct operational readiness assessments and capability gap analysis
Support technical hiring, training, and professional development to maintain mission-critical capabilities
Foster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordination
Interface directly with military cyber operations teams, intelligence analysts, and mission partners on operational matters
Ensure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholders
Provide situational awareness and operational status updates to program leadership and customers
Support planning and execution of defensive cyber operations including coordinated hunts and incident response
Present operational updates and threat briefings to C-suite and senior government leadership
Build and maintain strong operational relationships that enhance mission effectiveness and information sharing
Coordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterprise
Track and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectiveness
Generate regular operational reports on threat activity, incident response performance, and defensive posture
Identify operational trends through threat intelligence analysis and implement proactive defensive measures
Support after-action reviews (AARs) and lessons learned processes to improve operational effectiveness
Maintain operational documentation including standard operating procedures (SOPs), playbooks, and run books
Provide executive-level reporting on operational readiness and threat landscape
Ensure Service Level Agreement (SLA) compliance for detection, response, and escalation timelines
Assess and develop team capabilities to meet evolving threat landscape and mission requirements
Recommend training and professional development opportunities including certifications, technical training, and operational exercises
Support integration of new tools, techniques, and procedures (TTPs) into defensive operations
Lead operational training exercises and tabletop exercises to maintain team proficiency
Foster culture of continuous learning, threat intelligence sharing, and operational innovation
Develop and maintain threat-informed defensive strategies and operational concepts
Oversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber tools
Ensure integration and operational effectiveness of threat detection, hunting, and response technologies
Support tuning and optimization of detection content, correlation rules, and alert workflows
Coordinate with engineering teams on tool deployment, configuration, and operational support
Maintain situational awareness of network architecture, critical assets, and defensive coverage
Support continuous monitoring requirements for accredited systems and compliance with IA standards
Identify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operations
Develop and implement tactical response procedures and escalation protocols for cyber incidents
Ensure operational continuity during high-threat periods, system outages, or personnel transitions
Navigate operational constraints while maintaining unwavering mission focus and defensive posture
Support crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacks
Balance operational tempo with sustainable operations and team well-being during extended operations