Operating on-site, this role balances tactical cyber threat intelligence, alert triaging, packet analysis, and high-impact incident response coordination with a focus on team development, coaching, and operational alignment.

The position operates on a core 5x8 day shift to ensure maximum availability and continuity across 24x7 shifts, facilitate regular analyst engagements, and maintain communication with program and customer leadership.

Primary Responsibilities

Team Leadership & Development

• Conduct 1-on-1 check-ins with team members every two weeks to provide supportive, actionable career guidance, reduce operational burnout, and foster long-term retention.
• Partner with Operations Managers to facilitate advanced technical training, support certification pathways, and deliver objective, performance-driven reviews.
• Establish clear, mission-aligned performance expectations, follow through on team commitments, and address policy compliance and operational gaps fairly and promptly.
• Maintain strong ties with HR and leadership to resolve challenges, build psychological safety in high-stress classified environments, and focus the team on joint problem-solving during operational setbacks.
• Collaborate with Shift Leads and operations leadership on shift coverage, training schedules, and mission readiness within the SCIF, ensuring rapid recall capability during critical incidents.

Cybersecurity Monitoring & Analysis

• Lead analysts in evaluating alerts from endpoints, IDS/IPS, NetFlow, and custom network sensors across classified enclaves to identify, investigate, and mitigate sophisticated malicious activity.
• Correlate complex multi-source log data to produce detailed Cyber Incident Reports (CIR), integrate tactical threat intelligence feeds into SIEM platforms, and align analysis with MITRE ATT&CK and Cyber Kill Chain frameworks.
• Direct immediate reporting and applicable containment actions and escalate validated, critical security incidents to customer leadership, JFHQ-DODIN, and USCYBERCOM in accordance with DoD reporting standards.

Basic Qualifications

• Active DoD Top Secret / SCI security clearance
• Current DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, SSCP, GSEC, CySA+).
• Current CSSP-A or CSSP-IR certification (e.g., CySA+, CEH, GCIA, GCIH), or the ability to obtain within 180 days of hire.
• Strong technical mastery of TCP/IP networking, packet analysis (Wireshark/tcpdump), the OSI model, and defense-in-depth principles.
• Bachelor’s degree + 4 year of relevant operational cyber defense or SOC experience (or equivalent military/work experience).
• 100% on-site SCIF requirement; willingness to work the assigned 5x8 schedule and reside within a 2-hour physical recall commute of Hill AFB, UT; Scott AFB, IL; or Columbus, OH.

Preferred Qualifications

• Prior experience supporting DISA, DoD Cyber Security Service Providers (CSSP), or Service Cyber Components
• Hands-on technical experience operating enterprise SIEMs/log aggregators (such as Splunk, Elastic, or Sentinel) on classified networks.
• Familiarity with advanced threat actor TTPs, static/dynamic malware analysis, and CJCSM 6510 incident reporting procedures.
• Advanced cybersecurity certifications (such as SANS GIAC, CASP+, or CISSP).
• At least two years of experience leading, mentoring, or supervising cross-functional cybersecurity teams.

Pay Range: $87,100.00 - $157,450.00

XML job scraping automation by YubHub