Technical Lead - Cybersecurity Operations

Position Overview

The Technical Lead provides hands-on technical leadership for a large, mission-focused security operations environment. This position coordinates day-to-day technical execution, guides complex incident analysis and response, manages technical escalations, supports service continuity, and communicates operational status and risk to program and customer leadership. This is not a purely advisory or management role; the successful candidate must move effectively between executive communication, detailed technical review, operational decision support, and workforce mentoring.

Duties & Responsibilities

• Coordinate daily security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform-support functions.
• Serve as the technical escalation point for complex, sensitive, or high-impact incidents and service disruptions.
• Review incident scope, severity, evidence, likely cause, affected assets, operational impact, and recommended response actions.
• Guide containment, eradication, recovery, and post-incident improvement activities in coordination with system, network, identity, cloud, and security stakeholders.
• Track operational risks, technical dependencies, staffing-coverage concerns, service impacts, unresolved issues, and corrective actions.
• Prepare and present clear operational updates, technical briefings, risk summaries, and decision recommendations for diverse audiences.
• Lead transition, knowledge-transfer, continuity, and operational-readiness activities that preserve critical security functions during change or disruption.
• Maintain and improve operating procedures, escalation paths, contact information, response playbooks, and technical knowledge content.
• Mentor analysts, engineers, administrators, and technical leads; establish consistent technical-review and quality expectations.
• Identify recurring operational problems and sponsor practical improvements to tools, workflows, detection, response, documentation, and communication.

Qualifications

Minimum Requirements:

• Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
• Demonstrated ability to resolve undefined, highly complex, multidimensional technical problems requiring deep analysis and cross-functional collaboration.
• Experience leading technical teams and coordinating high-priority operational work in a large enterprise environment.
• Strong written and verbal communication skills, including the ability to explain technical risk and response options to senior stakeholders.
• Demonstrated record of mentoring technical staff and improving team capability.

Preferred Qualifications:

• Experience leading or serving as deputy technical lead for a large federal SOC, incident response center, or comparable enterprise security-operations program.
• Experience in hybrid on-premises and cloud environments, including AWS, Azure, or Microsoft 365.
• Experience supporting continuity exercises, major incident response, or large operational transitions.
• CISSP and GCIH preferred; GCFA, GREM, GCIA, GNFA, CISM, or PMP are also valuable.
• Working knowledge of widely used incident-response, security-control, and federal cybersecurity guidance.

What Success Looks Like

• Operational issues and technical risks are identified early, assigned clear ownership, and driven to evidence-based closure.
• Complex incidents receive disciplined analysis, clear recommendations, and coordinated response support.
• Technical teams work from current procedures, understand escalation paths, and maintain effective handoffs and backup coverage.
• Program and customer leaders receive concise, decision-ready information about service health, risk, and required action.

Education and Certifications:

• Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.

Clearance Level:

• Secret clearance preferred but not required.

Work Location

• Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.

Hours of Operation

• Core business hours with availability for after-hours escalation, on-call support, exercises, and continuity events.

• Ability to pass a minimum background investigation.