Description
The TS Mission Lead guides an operational team delivering 24x7 defensive cybersecurity monitoring and incident operations across Department of Defense (DoD) Top Secret and classified enterprise networks.
Operating on-site, this role balances tactical cyber threat intelligence, alert triaging, packet analysis, and high-impact incident response coordination with a focus on team development, coaching, and operational alignment.
The position operates on a core 5x8 day shift to ensure maximum availability and continuity across 24x7 shifts, facilitate regular analyst engagements, and maintain communication with program and customer leadership.
Primary Responsibilities
Team Leadership & Development
- Conduct 1-on-1 check-ins with team members every two weeks to provide supportive, actionable career guidance, reduce operational burnout, and foster long-term retention.
- Partner with Operations Managers to facilitate advanced technical training, support certification pathways, and deliver objective, performance-driven reviews.
- Establish clear, mission-aligned performance expectations, follow through on team commitments, and address policy compliance and operational gaps fairly and promptly.
- Maintain strong ties with HR and leadership to resolve challenges, build psychological safety in high-stress classified environments, and focus the team on joint problem-solving during operational setbacks.
- Collaborate with Shift Leads and operations leadership on shift coverage, training schedules, and mission readiness within the SCIF, ensuring rapid recall capability during critical incidents.
Cybersecurity Monitoring & Analysis
- Lead analysts in evaluating alerts from endpoints, IDS/IPS, NetFlow, and custom network sensors across classified enclaves to identify, investigate, and mitigate sophisticated malicious activity.
- Correlate complex multi-source log data to produce detailed Cyber Incident Reports (CIR), integrate tactical threat intelligence feeds into SIEM platforms, and align analysis with MITRE ATT&CK and Cyber Kill Chain frameworks.
- Direct immediate reporting and applicable containment actions and escalate validated, critical security incidents to customer leadership, JFHQ-DODIN, and USCYBERCOM in accordance with DoD reporting standards.
Basic Qualifications
- Active DoD Top Secret / SCI security clearance
- Current DoD 8570/8140 IAT Level II baseline certification (e.g., Security+ CE, SSCP, GSEC, CySA+).
- Current CSSP-A or CSSP-IR certification (e.g., CySA+, CEH, GCIA, GCIH), or the ability to obtain within 180 days of hire.
- Strong technical mastery of TCP/IP networking, packet analysis (Wireshark/tcpdump), the OSI model, and defense-in-depth principles.
- Bachelor’s degree + 4 year of relevant operational cyber defense or SOC experience (or equivalent military/work experience).
- 100% on-site SCIF requirement; willingness to work the assigned 5x8 schedule and reside within a 2-hour physical recall commute of Hill AFB, UT; Scott AFB, IL; or Columbus, OH.
Preferred Qualifications
- Prior experience supporting DISA, DoD Cyber Security Service Providers (CSSP), or Service Cyber Components
- Hands-on technical experience operating enterprise SIEMs/log aggregators (such as Splunk, Elastic, or Sentinel) on classified networks.
- Familiarity with advanced threat actor TTPs, static/dynamic malware analysis, and CJCSM 6510 incident reporting procedures.
- Advanced cybersecurity certifications (such as SANS GIAC, CASP+, or CISSP).
- At least two years of experience leading, mentoring, or supervising cross-functional cybersecurity teams.
Pay Range: $87,100.00 - $157,450.00