TECHNICAL LEAD - CYBERSECURITY OPERATIONS
About The Position
The Technical Lead provides hands-on technical leadership in a large, mission-focused security operations environment. The role coordinates day-to-day technical execution, guides complex incident analysis and response, manages technical escalations, supports service continuity, and communicates operational status and risk to program and customer leadership. It combines executive communication, detailed technical review, operational decision support, and workforce mentoring rather than being purely advisory or managerial. The position coordinates security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform support. It serves as the escalation point for complex or high-impact incidents and service disruptions, supports coordinated response and recovery, tracks operational risks and corrective actions, and maintains procedures and response knowledge. The Technical Lead also mentors technical staff and sponsors improvements to operational tools, workflows, detection, response, documentation, and communication. The work is in a hybrid federal customer environment, with regular onsite presence and possible travel between supported operating locations. Hours are core business hours, with availability for after-hours escalation, on-call support, exercises, and continuity events. An active Top Secret clearance is strongly preferred, and candidates must be able to pass a minimum background investigation.
Requirements
- Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
- Ability to resolve undefined, highly complex, multidimensional technical problems requiring deep analysis and cross-functional collaboration.
- Experience leading technical teams and coordinating high-priority operational work in a large enterprise environment.
- Strong written and verbal communication skills, including explaining technical risk and response options to senior stakeholders.
- Demonstrated record of mentoring technical staff and improving team capability.
- Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.
- Ability to pass a minimum background investigation.
Nice To Haves
- Experience leading or serving as deputy technical lead for a large federal SOC, incident response center, or comparable enterprise security-operations program.
- Experience in hybrid on-premises and cloud environments, including AWS, Azure, or Microsoft 365.
- Experience supporting continuity exercises, major incident response, or large operational transitions.
- CISSP and GCIH preferred; GCFA, GREM, GCIA, GNFA, CISM, or PMP are also valuable.
- Working knowledge of widely used incident-response, security-control, and federal cybersecurity guidance.
- Active Top Secret clearance strongly preferred.
Responsibilities
- Coordinate daily security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform-support functions.
- Serve as the technical escalation point for complex, sensitive, or high-impact incidents and service disruptions.
- Review incident scope, severity, evidence, likely cause, affected assets, operational impact, and recommended response actions.
- Guide containment, eradication, recovery, and post-incident improvement activities in coordination with system, network, identity, cloud, and security stakeholders.
- Track operational risks, technical dependencies, staffing-coverage concerns, service impacts, unresolved issues, and corrective actions.
- Prepare and present operational updates, technical briefings, risk summaries, and decision recommendations for diverse audiences.
- Lead transition, knowledge-transfer, continuity, and operational-readiness activities that preserve critical security functions during change or disruption.
- Maintain and improve operating procedures, escalation paths, contact information, response playbooks, and technical knowledge content.
- Mentor analysts, engineers, administrators, and technical leads; establish consistent technical-review and quality expectations.
- Identify recurring operational problems and sponsor practical improvements to tools, workflows, detection, response, documentation, and communication.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
