Security Operations Manager

Astraeus Operations LLC • , VA

2d • $185,000 - $188,000

About The Position

The Security Operations Manager serves as an on-floor subject matter expert supporting Google Public Sector’s 24/7/365 Tier 1 security operations in sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across Google sovereign infrastructure and air-gapped offerings. The manager leads shift operations, coaches analysts, pre-screens technical escalations to Google SecOps engineering, and drives security playbook and alert-tuning improvements while ensuring high-confidence triage, timely responses, and continued partner ownership of incidents.

The role is based in Tysons Corner, Virginia, and supports round-the-clock operations, including overnight, weekend, and holiday coverage. It requires an active TS/SCI with Full Scope Polygraph and an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification before starting billable work. The successful candidate must complete Google’s extended workforce onboarding and required government-contract compliance and pass background and drug screening.

Requirements

• At least 5 years of experience in security operations (SOC) or incident response, including leading shift operations, pre-screening technical escalations, coaching security analysts, and partnering with engineering teams on SIEM detection tuning and playbook development.
• Strong hands-on experience with SIEM, IDS, EDR, and case management or ticketing tools.
• Technical experience supporting Windows and Linux operating systems, networking infrastructure, scripting, and security application troubleshooting.
• Possess and maintain an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification before starting billable work, such as CySA+, GCIA, GCIH, CEH, or CISSP.
• Successfully complete Google’s extended workforce onboarding process and maintain required government-contract compliance, including mandatory training.
• Active TS/SCI with Full Scope Polygraph.
• Successfully pass background and drug screening.
• General knowledge of network analysis, vulnerability scanning (such as Nessus), security hardening best practices (such as DISA STIG), and vulnerability landscapes (such as OWASP Top 10).
• Clear technical and customer communication, including the ability to explain incident findings, review diagnostic summaries and reports, and provide actionable coaching to analysts.
• Ability to lead collaboratively in classified, mission-critical environments, safeguard sensitive information, and reinforce security procedures, approved runbooks, and escalation protocols.
• Sound operational judgment and prioritization; ability to oversee live queues, recognize approaching SLA deadlines, direct timely follow-on actions, and maintain accurate incident and shift records.
• Strong analytical and troubleshooting skills to assess SIEM/EDR findings, correlate evidence, validate triage justifications, and pre-screen technical escalations for Google SecOps engineering.
• Ability to reinforce end-to-end partner incident ownership during consults, sustain customer updates, and ensure complete, immediately accepted High/Critical shift handoffs.
• Ability to coach analysts, identify recurring noisy alerts and broken playbooks, and partner with engineering teams on detection tuning, playbook development, and operational improvement.
• Ability to support 24/7/365 operations, including overnight, weekend, and holiday coverage; coordinate room presence; and adapt to changing mission needs and operational disruptions.

Nice To Haves

• Bachelor’s degree in cybersecurity or computer science, or equivalent practical experience.
• Experience in a dedicated SOC, including event analysis using Splunk, ELK, or other SIEM systems.
• Hands-on security detection development and alert tuning in partnership with Tier 2 and Tier 3 engineering teams, supporting continuous improvement of SOC playbooks.
• Experience compiling threat reports that translate complex indicators of compromise (IOCs) into clear narrative overviews for customer and technical audiences.
• Advanced understanding of LAN/WAN topologies, Google Cloud Platform, Kubernetes, and air-gapped computing environments.
• Experience operating in classified SCIF environments, handling sensitive or classified data, or supporting cloud environments.
• Elastic Certified SIEM Analyst or Splunk Core Certified User certification.
• Foundational understanding of LAN/WAN topologies, Kubernetes, and air-gapped computing environments.

Responsibilities

• Lead on-floor Tier 1 security operations and coach analysts monitoring GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools, Splunk, ELK, designated SIEM systems, and EDR tools.
• Oversee initial GPS customer and incident-reporting support through email and support portals; ensure alerts are acknowledged within 5 minutes, with a First Meaningful Response within 15 minutes for High/Critical alerts and 25 minutes for all others.
• Guide incident-detail collection, severity categorization, event enrichment, and correlation; validate evidence and disposition justifications; and ensure true positives are escalated to the appropriate Google SecOps representative according to procedures and runbooks.
• Ensure partner ownership of ServiceNow incidents, investigations, customer updates, follow-on actions, and required government incident-report drafts during Google technical consults; transfer ownership only with explicit Google manager approval and coordinate incident response and required EDR tooling with Google SecOps.
• Pre-screen technical consults during core hours using analyst summaries of Observed Activity, Playbooks/Queries Run, IOCs, and Proposed Disposition; review off-hours pre-screening by designated senior analysts the next business day.
• Ensure active High/Critical handoffs include Current Status, Analysis Completed, and Next Steps and are immediately accepted by the incoming shift without rejection.
• Drive playbook development, validation, and continuous improvement with engineering teams; track noisy alerts and broken playbooks; coach analysts on appropriate responses; and partner on SIEM detection tuning.
• Provide hands-on-keyboard accreditation support to validate playbooks, runbooks, IT infrastructure, and Data Center operations.
• Coordinate operational coverage to maintain at least two active personnel and at least one FTE in each occupied SecOps room, accounting for holidays, PTO, training, and severe or inclement weather.
• Ensure SecOps calls are answered and routed, on-call guidance is sought as needed, and virtual communications receive responses within 15 minutes.
• Serve as live Queue Manager or ensure a designated senior on-shift analyst fills the role each shift; monitor alert timers and intervene at least 5 minutes before response targets expire.
• Attend requested customer situational awareness calls and ensure noteworthy information and tasking are relayed through designated channels within 1 hour, using appropriate unclassified wording when required.
• Coordinate weekly activity reporting due Friday by 15:00 EDT, covering alert response SLA compliance, triage dispositions, playbooks validated or updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing.
• Provide operational inputs on hours incurred, upcoming-month support, and active issues or blockers for monthly financial status reports due by the following month’s 10th.
• Perform other duties as assigned.

Benefits

• Professional development opportunities, including on-the-job learning experiences and formal development programs.
• Well-being programs.
• Flexibility to make daily choices that support health and well-being.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed