Security Operations Manager

Chenega Corporation•UNAVAILABLE, Virginia

About The Position

The Security Operations Manager serves as an on-floor subject matter expert supporting Google Public Sector’s 24/7/365 Tier 1 security operations in sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across Google sovereign infrastructure and air-gapped offerings. The manager leads shift operations, coaches analysts, pre-screens technical escalations to Google SecOps engineering, and drives security playbook and alert-tuning improvements while ensuring high-confidence triage, timely responses, and continued partner ownership of incidents. The role is based in Tysons Corner, Virginia. It requires an active TS/SCI with Full Scope Polygraph, a current qualifying DoD 8140 Cyber Defense Analyst certification before billable work, successful completion of Google’s extended workforce onboarding, government-contract compliance, and successful background and drug screening. The estimated salary range is USD $185,000 to USD $188,000 per year.

Requirements

At least 5 years of experience in security operations (SOC) or incident response, including leading shift operations, pre-screening technical escalations, coaching security analysts, and partnering with engineering teams on SIEM detection tuning and playbook development.
Strong hands-on experience with SIEM, IDS, EDR, and case management or ticketing tools.
Technical experience supporting Windows and Linux operating systems, networking infrastructure, scripting, and security application troubleshooting.
Possess and maintain an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification before starting billable work, such as CySA+, GCIA, GCIH, CEH, or CISSP.
Successfully complete Google’s extended workforce onboarding process and maintain required government-contract compliance, including mandatory training.
Active TS/SCI with Full Scope Polygraph.
Successfully pass background and drug screening.
General knowledge of network analysis, vulnerability scanning (such as Nessus), security hardening best practices (such as DISA STIG), and vulnerability landscapes (such as OWASP Top 10).
Foundational understanding of LAN/WAN topologies, Kubernetes, and air-gapped computing environments.
Clear technical and customer communication; ability to explain incident findings, review diagnostic summaries and reports, and provide actionable coaching to analysts.
Ability to lead collaboratively in classified, mission-critical environments, safeguard sensitive information, and reinforce security procedures, approved runbooks, and escalation protocols.
Sound operational judgment and prioritization; ability to oversee live queues, recognize approaching SLA deadlines, direct timely follow-on actions, and maintain accurate incident and shift records.
Strong analytical and troubleshooting skills to assess SIEM/EDR findings, correlate evidence, validate triage justifications, and pre-screen technical escalations for Google SecOps engineering.
Ability to reinforce end-to-end partner incident ownership during consults, sustain customer updates, and ensure complete, immediately accepted High/Critical shift handoffs.
Ability to coach analysts, identify recurring noisy alerts and broken playbooks, and partner with engineering teams on detection tuning, playbook development, and operational improvement.
Ability to support 24/7/365 operations, including overnight, weekend, and holiday coverage; coordinate room presence; and adapt to changing mission needs and operational disruptions.

Nice To Haves

Bachelor’s degree in cybersecurity or computer science, or equivalent practical experience.
Experience in a dedicated SOC, including event analysis using Splunk, ELK, or other SIEM systems.
Hands-on security detection development and alert tuning in partnership with Tier 2 and Tier 3 engineering teams, supporting continuous improvement of SOC playbooks.
Experience compiling threat reports that translate complex indicators of compromise (IOCs) into clear narrative overviews for customer and technical audiences.
Advanced understanding of LAN/WAN topologies, Google Cloud Platform, Kubernetes, and air-gapped computing environments.
Experience operating in classified SCIF environments, handling sensitive or classified data, or supporting cloud environments.
Elastic Certified SIEM Analyst or Splunk Core Certified User certification.

Responsibilities

Lead on-floor Tier 1 security operations and coach analysts monitoring GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools, Splunk, ELK, designated SIEM systems, and EDR tools.
Oversee initial GPS customer and incident-reporting support through email and support portals; ensure alerts are acknowledged within 5 minutes and receive a First Meaningful Response within 15 minutes for High/Critical alerts and 25 minutes for all others.
Guide incident-detail collection, severity categorization, event enrichment, and correlation; validate evidence and disposition justifications; and ensure true positives are escalated to the appropriate Google SecOps representative according to procedures and runbooks.
Ensure partner ownership of ServiceNow incidents, investigations, customer updates, follow-on actions, and required government incident-report drafts continues during Google technical consults. Transfer ownership only with explicit Google manager approval, and coordinate incident response and required EDR tooling with Google SecOps.
Pre-screen technical consults during core hours using analyst summaries of Observed Activity, Playbooks/Queries Run, IOCs, and Proposed Disposition; review off-hours pre-screening by designated senior analysts the next business day.
Ensure active High/Critical handoffs include Current Status, Analysis Completed, and Next Steps and are immediately accepted by the incoming shift without rejection.
Drive playbook development, validation, and continuous improvement with engineering teams; track noisy alerts and broken playbooks; coach analysts on responses; and partner on SIEM detection tuning.
Provide hands-on-keyboard accreditation support to validate playbooks, runbooks, IT infrastructure, and Data Center operations.
Coordinate operational coverage to maintain at least two active personnel and at least one FTE in each occupied SecOps room, including during holidays, PTO, training, and severe or inclement weather.
Ensure SecOps calls are answered and routed, on-call guidance is sought as needed, and virtual communications receive responses within 15 minutes.
Serve as live Queue Manager or ensure a designated senior on-shift analyst fills the role each shift; monitor alert timers and intervene at least 5 minutes before response targets expire.
Attend requested customer situational awareness calls and ensure noteworthy information and tasking are relayed through designated channels within 1 hour, using appropriate unclassified wording when required.
Coordinate weekly activity reporting due Friday by 15:00 EDT, covering alert response SLA compliance, triage dispositions, playbooks validated or updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing.
Provide operational inputs on hours incurred, upcoming-month support, and active issues or blockers for monthly financial status reports due by the following month’s 10th.
Perform other duties as assigned.