Technical Lead - Cybersecurity Operations
About The Position
The Technical Lead provides hands-on technical leadership for a large, mission-focused security operations environment. The role coordinates day-to-day technical execution, guides complex incident analysis and response, manages technical escalations, supports service continuity, and communicates operational status and risk to program and customer leadership. It requires moving between executive communication, detailed technical review, operational decision support, and workforce mentoring. The position coordinates security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform support. It serves as the technical escalation point for complex or high-impact incidents and service disruptions, and guides response and recovery with system, network, identity, cloud, and security stakeholders. The role also supports operational readiness and continuity, maintains procedures and response knowledge, mentors technical staff, and sponsors practical improvements to operations. The position is based in a hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required. Core business hours apply, with availability for after-hours escalation, on-call support, exercises, and continuity events. A minimum background investigation is required; Secret clearance is preferred but not required.
Requirements
- Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
- Ability to resolve undefined, highly complex, multidimensional technical problems requiring deep analysis and cross-functional collaboration.
- Experience leading technical teams and coordinating high-priority operational work in a large enterprise environment.
- Strong written and verbal communication skills, including the ability to explain technical risk and response options to senior stakeholders.
- Demonstrated record of mentoring technical staff and improving team capability.
- Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.
- Ability to pass a minimum background investigation.
Nice To Haves
- Experience leading or serving as deputy technical lead for a large federal SOC, incident response center, or comparable enterprise security-operations program.
- Experience in hybrid on-premises and cloud environments, including AWS, Azure, or Microsoft 365.
- Experience supporting continuity exercises, major incident response, or large operational transitions.
- CISSP or GCIH; GCFA, GREM, GCIA, GNFA, CISM, or PMP are also valuable.
- Working knowledge of widely used incident-response, security-control, and federal cybersecurity guidance.
- Secret clearance is preferred but not required.
Responsibilities
- Coordinate daily security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform-support functions.
- Serve as the technical escalation point for complex, sensitive, or high-impact incidents and service disruptions.
- Review incident scope, severity, evidence, likely cause, affected assets, operational impact, and recommended response actions.
- Guide containment, eradication, recovery, and post-incident improvement activities with system, network, identity, cloud, and security stakeholders.
- Track operational risks, technical dependencies, staffing-coverage concerns, service impacts, unresolved issues, and corrective actions.
- Prepare and present operational updates, technical briefings, risk summaries, and decision recommendations for diverse audiences.
- Lead transition, knowledge-transfer, continuity, and operational-readiness activities that preserve critical security functions during change or disruption.
- Maintain and improve operating procedures, escalation paths, contact information, response playbooks, and technical knowledge content.
- Mentor analysts, engineers, administrators, and technical leads; establish consistent technical-review and quality expectations.
- Identify recurring operational problems and sponsor improvements to tools, workflows, detection, response, documentation, and communication.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
