Cyber Security Operations Senior Manager

The Cyber Security Operations Senior Manager serves as the operational commander technical mentor and strategicleader for the Cyber Security Operations team. Reporting directly to the Chief Information Security Officer (CISO)this position is pivotal in safeguarding critical national security infrastructure while building and scaling a resilienthigh-capability cyber defense organization.

This is a player-coach leadership role designed for an operational cyber practitioner who is equally passionateabout modern defensive technical strategysuch as Zero Trust Architecture (ZTA) Defense-in-Depth (DiD) threathunting and proactive detection engineeringand developing people. As manager you will serve as a forcemultiplier: elevating the technical depth of the existing team fostering a continuous learning environment andtranslating complex adversary threat intelligence into actionable operational defenses.

You will oversee Defensive Cyber Operations (DCO) Cyber Security Engineering and Incident Response (CSIRT)activities in close collaboration with the Network Operations Center/Security Operations Center (NOC/SOC)Formal Authorization and Risk Management team and Department of Energy (DOE)/National Nuclear SecurityAdministration (NNSA) stakeholders to outpace evolving threats.

Specific Job Responsibilities
Team Leadership Mentorship & Talent Growth

• Build Team Depth & Capability: Serve as a dedicated mentor and technical coach to junior mid-level andsenior analysts; design clear skill-development pathways cross-training initiatives and knowledge-sharingframeworks to expand the teams operational bench depth.
• Cultivate an Operational Culture: Lead empower and inspire a service-oriented cyber operations teamfostering an environment of curiosity technical rigor open communication and shared accountability.
• Resource & Workload Management: Plan prioritize and coordinate staff assignments across operationalshifts incident response tasks and long-term security engineering projects to maintain team health andoperational readiness.

Defensive Operations Threat Hunting & Incident Command

• Proactive Threat Hunting: Lead the strategy for active threat hunting using the MITRE ATT&CK frameworkto detect living-off-the-land (LotL) techniques covert persistence and anomalous activity before impactoccurs.
• Incident Response Oversight: Oversee all Cyber Security Incident Response (CSIRT) activities(collaborating with delegated incident leads) acting as the senior operational escalation authority and crisiscommander during high-severity cyber events.
• Playbook & Detection Modernization: Drive continuous improvement of incident playbooks automatedresponse workflows and Security Information and Event Management (SIEM)/Extended Detection andResponse (XDR) detection rules (specifically within Splunk) to maximize analyst efficiency and reduce time-to-detect/time-to-respond.

Security Engineering & Practical Defense-in-Depth

• Zero Trust & Hardening Strategy: Guide security engineering efforts to transition legacy network posturestoward Zero Trust Architecture (ZTA) principles enhanced micro-segmentation and identity-bound accesscontrols.
• Vulnerability & Exposure Management: Oversee enterprise vulnerability scanning risk prioritization ( States Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities(KEVs) and mitigation strategies in partnership with Information Technology (IT) and Network Operations.
• Threat Modeling & Validation: Conduct threat scenario walkthroughs coordinate red/blue team exercisesand oversee penetration testing efforts to validate the real-world effectiveness of existing security controls.

Strategic Communication & Governance

• Executive & Stakeholder Engagement: Maintain clear concise and timely operational communicationswith the CISO executive leadership and external federal/DOE stakeholders during routine operations andelevated threat conditions.
• RMF & Continuous Monitoring Integration: Bridge operational defense with governance by translatingNational Institute of Standards and Technology (NIST) Risk Management Framework (RMF) guidance intocontinuous monitoring metrics and leveraging automated electronic Governance Risk and Compliance(eGRC) tools.

• Bachelors Degree and minimum 10 years of relevant experience.
• OR applicants without a bachelors degree may be considered based on a combination of at least 18 years of completed education and/or relevant experience.

Not applicable.

Three years of supervisory/management experience. Candidates with less years of supervisory/management experience will be required to complete a developmental plan approved by the Division Director or their delegate.

Leadership & Mentorship Excellence

• Proven track record of successfully growing mentoring and retaining technical cyber security staff with afocus on knowledge transfer and elevating team capability.
• Strong interpersonal and service-oriented leadership skills with demonstrated success managing cross-functional technical teams and complex projects.

Core Technical & Operational Capabilities

• Practical Cyber Operations: Extensive hands-on experience in security operations (SOC) advanced threathunting log management/analysis and coordinating responses to sophisticated attacks (including AdvancedPersistent Threat (APT) vectors).
• SIEM & Analytics: In-depth experience with Splunk (or equivalent enterprise SIEM platforms) custom SPLdetection development and behavioral analytics.
• Defensive Engineering & Architecture: Deep understanding of security engineering principles Next-Generation Firewalls (NGFW) Intrusion Detection/Prevention Systems (IDS/IPS) Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR) authentication mechanisms and network securitybaselines.
• Zero Trust & Security Frameworks: Familiarity with implementing practical Zero Trust concepts (NISTSpecial Publication (SP) 800-207) and Defense-in-Depth strategies in complex environments.
• Vulnerability Assessment: Experience utilizing Tenable/Nessus or automated compliance scanningplatforms to identify and remediate enterprise risks.

Federal Frameworks & Mission Context

• Knowledge of Federal cybersecurity standards and risk baselines (e.g. NIST Cybersecurity Framework NISTSP 800-53 NIST SP 800-37/39 RMF Department of Defense (DoD) Security Technical Implementation Guides (STIGs) Committee on National Security Systems Introduction (CNSSI) 1253).
• Familiarity with Department of Energy (DOE) / National Nuclear Security Administration (NNSA) cybersecurityrequirements eGRC tools or national laboratory environments.
• Professional certifications that demonstrate practical technical or leadership growth (e.g. CertifiedInformation Systems Security Professional (CISSP) Certified Information Security Manager (CISM) GIACCertified Incident Handler (GCIH) GIAC Certified Forensic Analyst (GCFA) Certified Ethical Hacker (CEH) orequivalent hands-on credentials).