SECURITY OPERATIONS LEAD

Location: 1775 Duke Street, Alexandria, Virginia

Work arrangement: 100% onsite during the first 30 days, followed by three onsite days per week

Operational coverage: The SOC must operate between 6:00 a.m. and 6:00 p.m.; individual schedule will be established based on coverage requirements

Citizenship: U.S. citizenship required

Clearance: Top Secret Clearance REQUIRED.

POSITION SUMMARY

Cloud9 Security Services is seeking a senior Security Operations Lead to direct cybersecurity monitoring, detection, vulnerability management, security engineering, and penetration-testing support for the National Credit Union Administration’s Security Operations Center.

The Security Operations Lead will be responsible for maintaining comprehensive situational awareness, visibility, and response readiness across NCUA’s unclassified environment. The individual will direct security operations personnel, manage cybersecurity technologies, improve detection capabilities, coordinate vulnerability remediation, and ensure security products and services are properly architected, configured, deployed, and maintained.

PRIMARY RESPONSIBILITIES

• Lead and direct daily Security Operations Center activities supporting NCUA’s unclassified environment.

• Manage security operations personnel and coordinate coverage within the SOC’s 6:00 a.m. to 6:00 p.m. operating window.

• Maintain, update, and improve the SOC Concept of Operations and Standard Operating Procedures in accordance with NIST guidance, federal regulations, and industry best practices.

• Monitor, defend, and protect network perimeter interfaces from malicious traffic and unauthorized activity.

• Monitor hosts and endpoints within the NCUA environment for malicious activity, compromised accounts, and lateral movement.

• Direct advanced analysis of inbound and outbound network traffic.

• Oversee the initial triage, containment, categorization, documentation, and escalation of suspicious events and potential incidents.

• Perform or direct rapid analysis of potential incidents generated through near-real-time security alerts.

• Operate and maintain cybersecurity technologies, including Endpoint Detection and Response, Security Information and Event Management, Security Orchestration, Automation, and Response, vulnerability-management, and network-security platforms.

• Tune and optimize detections, signatures, analytics, correlation rules, use cases, and automated response rules.

• Apply knowledge of adversary tactics, techniques, and procedures to create new detections and analytics for endpoint and network activity.

• Receive, document, evaluate, and process reports of potential security incidents received from NCUA personnel, third parties, email, ticketing systems, or verbal reports.

• Coordinate with incident-management personnel during security incidents or suspected compromises.

• Conduct security-impact assessments and risk analyses for vulnerabilities, incidents, system changes, and change requests.

• Implement applicable phases of the Continuous Diagnostics and Mitigation program.

• Establish security-tool configuration baselines and ensure tools are properly configured, deployed, integrated, and operational.

• Architect, deploy, operate, and maintain security products and services.

• Recommend and implement technical solutions that protect data throughout its lifecycle.

• Manage asset and vulnerability-management activities across IT and operational-technology environments.

• Ensure security tools are installed and operating in accordance with established service-level requirements.

• Maintain current knowledge of assets, networks, services, system interdependencies, business criticality, and cybersecurity risk.

• Oversee vulnerability scanning for patch levels, installed software, security configurations, compliance status, and technical risk.

• Accept, triage, and analyze vulnerability reports submitted by researchers and other sources.

• Coordinate vulnerability remediation with system owners, technical teams, CISA, and NCUA stakeholders.

• Validate that vulnerabilities have been remediated and properly documented.

• Maintain the accuracy of NCUA and CISA Continuous Diagnostics and Mitigation dashboards.

• Develop and publish SOC, asset-management, and vulnerability-management dashboards, reports, and visualizations.

• Coordinate or oversee penetration-testing support when required.

REQUIRED EDUCATION

• Bachelor of Science in Information Technology, Computer Science, Cybersecurity, Information Security, or a related technical field.

REQUIRED EXPERIENCE

• At least 10 years of experience providing security operations and penetration-testing support.

• At least five years of experience managing and directing cybersecurity or Security Operations Center teams.

• Demonstrated experience implementing Continuous Diagnostics and Mitigation capabilities.

• Experience establishing configuration and deployment baselines for cybersecurity tools.

• Experience architecting, deploying, integrating, operating, and maintaining enterprise security products and services.

• Experience developing and implementing solutions that protect data throughout its lifecycle.

• Experience with SOC monitoring, incident triage, threat detection, vulnerability management, security engineering, and penetration-testing coordination.

• Experience tuning SIEM, EDR, SOAR, correlation rules, analytics, signatures, and automated response capabilities.

• Strong knowledge of operating systems, network protocols, adversary behavior, and common attack techniques.

CERTIFICATIONS

• CISSP-ISSMP required.

• CISSP-ISSAP required.

• Certified Network Security Engineer preferred.

KNOWLEDGE AND SKILLS

• Security Operations Center leadership

• SIEM, SOAR, and EDR platforms

• Continuous Diagnostics and Mitigation

• Vulnerability scanning and remediation

• Security architecture and engineering

• Penetration-testing support

• Incident triage, containment, and escalation

• Threat detection and behavioral analytics

• Adversary tactics, techniques, and procedures

• Network traffic and endpoint analysis

• Detection engineering and use-case development

• Security-tool configuration baselines

• Asset discovery and asset-risk management

• Cybersecurity dashboards and metrics

• NIST guidance and federal cybersecurity requirements

• Data protection throughout the information lifecycle

Cloud 9 Security Services

Latest Jobs

Security Operations Lead