Security Ops Manager
About The Position
Altus Consulting is seeking experienced Security Operations Managers to lead shift operations within a 24/7/365 cleared cloud Security Operations Center supporting a mission-critical federal customer environment. This hands-on role provides operational leadership, manages security alert queues, guides incident triage and escalation, coaches analysts, and ensures consistent execution of security operations procedures. Managers work directly alongside analysts, maintain awareness of active incidents, oversee shift transitions, and collaborate with engineering teams to improve detections, playbooks, and operational performance. The position requires support for assigned day, swing, night, weekend, or holiday coverage and customer-specific onboarding, access, training, and qualification requirements. An active TS/SCI clearance with Full Scope Polygraph, U.S. citizenship, at least five years of relevant experience, and an applicable Cyber Defense Analyst role-qualifying certification are required before performing billable work.
Requirements
- Active TS/SCI clearance with Full Scope Polygraph.
- U.S. citizenship.
- Five or more years of Security Operations Center or incident response experience.
- Previous experience leading security operations shifts and coaching security analysts.
- Hands-on experience with SIEM, EDR, IDS, and security case-management technologies.
- Experience supporting Windows and Linux environments, network infrastructure, and security applications.
- Working knowledge of network analysis, vulnerability management, and security hardening practices.
- Ability to support a 24/7 operational environment, including assigned day, swing, night, weekend, or holiday coverage.
- Ability to satisfy customer-specific onboarding, access, training, and qualification requirements.
- Possession of an applicable Cyber Defense Analyst role-qualifying certification before performing billable work; listed certifications include CompTIA CySA+, GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), Certified Ethical Hacker (CEH), and CISSP.
Nice To Haves
- Extensive experience in a Security Operations Center or Cyber Incident Response environment.
- Hands-on experience with SIEM platforms such as Splunk, Elastic/ELK, Google SecOps/Chronicle, or comparable technologies.
- Experience with EDR, IDS, case management, and incident response technologies.
- Experience with ServiceNow or comparable security case-management platforms.
- Experience with Google SecOps/Chronicle, YARA-L, SOAR, Google Cloud IAM, Cloud Audit Logs, or Security Command Center.
- Knowledge of Windows and Linux operating systems, networking, vulnerability management, and security hardening.
- Experience with Kubernetes, cloud security, or air-gapped computing environments.
- Experience developing or tuning security detections and response playbooks.
- Previous experience supporting classified, SCIF, Intelligence Community, Department of Defense, or Federal cybersecurity environments.
- Strong leadership, analytical, written, and verbal communication skills.
Responsibilities
- Lead day-to-day Security Operations Center activities during assigned shifts and serve as the primary technical and operational resource for analysts.
- Manage active security alert queues and ensure alerts and incidents are acknowledged, investigated, documented, and escalated within established service levels.
- Review and pre-screen technical escalations before engaging higher-tier security engineering resources.
- Coach analysts on alert triage, SIEM and EDR analysis, incident investigation, documentation, and escalation procedures.
- Coordinate structured shift handoffs for active High and Critical incidents.
- Identify noisy alerts, recurring false positives, ineffective playbooks, and opportunities to improve detections and operational processes.
- Collaborate with security engineers to improve SIEM detections, response procedures, and playbooks.
- Support incident reporting, operational metrics, situational awareness, and recurring customer reporting.
- Ensure security operations procedures, runbooks, documentation standards, and customer requirements are followed.
- Provide hands-on support for security playbook and runbook testing and validation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
