Deputy Operations Lead Active Top Secret

The role supports the Operations Lead Engineering by providing technical and operational leadership to a multidisciplinary team of system administrators network engineers and cybersecurity engineers responsible for ensuring 24x7x365 operational readiness of SOC infrastructure and services. This position assumes full authority in the absence of the Operations Lead.

Operational Leadership & Oversight

• Assist the Operations Lead Engineering in guiding daily technical and operational activities across engineering teams.
• Assume full authority of the Operations Lead during absences including personnel management customer engagement and critical operational decision-making.
• Supervise and mentor system administrators network engineers and SOC engineering staff during assigned shifts.
• Manage shift scheduling coverage planning oncall rotations surge support and contingency staffing.
• Provide hands-on coverage for engineering shifts during staffing gaps or surge events.
• Deliver recurring operational and security briefings to federal clients senior leadership and stakeholders.
• Provide written and verbal status reporting on engineering operations incidents and team performance.

• Perform hands-on system administration tasks including configuration patching hardening and lifecycle management across Windows Server and Linux/Unix environments.
• Manage virtualization platforms (e.g. VMware HyperV) and cloud environments (e.g. AWS GovCloud Azure Government).
• Recommend and implement solutions to remediate security issues outages and system performance problems.
• Support the deployment integration and sustainment of SOC security tools including SIEM IDS/IPS EDR/XDR firewalls proxies and log aggregation systems.
• Maintain hardware/software inventories support capacity planning and assist in technology refresh cycles.
• Monitor globally deployed agents servers workstations and SOC infrastructure for vulnerabilities performance degradation and service disruptions.

• Participate in security tests evaluations studies and experiments impacting SOC readiness.
• Ensure adherence to security frameworks policies and directives (e.g. NIST SP 80053 FISMA DISA STIGs DoS IT Security policies).
• Support O&M contractual compliance SLA adherence and timely delivery of cybersecurity products and services.
• Support ATO compliance activities across applicable networks and security classifications.
• Assist in monitoring and improving incident problem request and changemanagement processes.
• Coordinate with SOC Analysts Incident Responders and Threat Intelligence teams to ensure engineering infrastructure meets mission requirements.

• Support the Operations Lead during highseverity cybersecurity incidents assisting with coordination communication escalations and recovery.
• Assume incident lead responsibilities during the Operations Leads absence.
• Participate in after-action reviews and ensure corrective actions are documented tracked and completed.
• Support Continuity of Operations (COOP) planning and execution for SOC engineering infrastructure.
• Assist in maintaining operational readiness plans escalation procedures contact rosters and continuity documentation.

• Develop maintain and enforce SOC engineering SOPs runbooks and technical documentation.
• Contribute to centralized service catalog development using ITIL practices.
• Maintain and update SOC knowledge base documentation troubleshooting guidance and lessons learned.
• Identify and support automation opportunities (e.g. reporting ticket validation monitoring patch management).
• Participate in working-group sessions to identify issues develop user stories define requirements and refine acceptance criteria.
• Support the definition implementation and monitoring of IT and cybersecurity processes to align with federal requirements and mission objectives.

• Audit and validate ServiceNow tickets to ensure accuracy completeness and compliance.
• Track cybersecurity metrics operational trends SLA performance and service delivery data using ServiceNow and approved reporting tools.
• Provide summary reports and surface significant issues risks and operational impacts to the Operations Lead.

• Coordinate with third-party service providers and technical teams to resolve failures escalate critical issues and maintain high availability.
• Collaborate with system owners IT teams and stakeholders to assess cybersecurity needs and translate them into actionable solutions.
• Support cross-functional initiatives to strengthen cybersecurity posture and improve Transition to Operations lifecycle.

• Perform additional cybersecurity operations and service-management tasks as assigned.

Education:

• Bachelors Degree required and 6 years of relevant experience.
  • Four (4) additional years of relevant experience may be substituted in lieu of a degree.

Required Certifications:

(Applicants must currently hold one of the following or obtain one prior to start; continued certification required):

• CAP;CASP CE;CCISO;CCNA-Security;CISM;CISSP (or Associate);CND;CSSLP;CySA; GICSP;GSEC;GSLC;Security CE;SSCP;PPDA;Agile IC;SNOW App Dev

Required Technical Experience:

• Systems Administration: Hands-on experience administering Windows Server and/or Linux/Unix in enterprise or government environments; proficiency with Active Directory Group Policy DNS DHCP and PKI.
• Network Engineering: Experience configuring and troubleshooting physical and virtual network infrastructure including routing protocols (BGP OSPF) switching technologies firewalls and VPNs.
• Virtualization & Cloud: Experience with VMware vSphere/ESXi Hyper-V and government cloud environments such as AWS GovCloud or Azure Government.
• Security Tools: Experience deploying/managing SIEM (Splunk ArcSight Microsoft Sentinel) IDS/IPS EDR/XDR and network monitoring platforms.

Required Operational Experience:

• Demonstrated technical task management and supervisory or team lead experience within 24x7 operational environments.
• Experience supporting cybersecurity or information assurance programs of similar size and complexity to the program.
• Experience operating in 24x7x365 environments including shift rotation and surge staffing.
• Experience in network technology management or operations with increasing responsibilities.
• Experience supporting network security monitoring and incident response.
• Experience working with ITSM platforms (ServiceNow preferred) including ticket documentation auditing and metrics tracking.
• Experience participating in after-action reviews documenting lessons learned and tracking corrective actions.
• Experience supporting vulnerability remediation and patch management across enterprise or multi-enclave environments.
• U.S. citizenship required.
• Active Top Secret security clearance.

• One or more of the following certifications: CISSP CISM CEH CompTIA Security CCNP Security CCNA AWS Certified Solutions Architect Microsoft Certified: Azure Administrator VMware VCP GIAC GCED/GCIA/GCIH.
• Experience supporting U.S. Department of State or other federal civilian agency cybersecurity programs.
• Familiarity with DoS IT Security policies FISMA reporting requirements and ATO/RMF processes.
• Experience with Zero Trust Architecture (ZTA) concepts or implementation.
• Experience with SDWAN MPLS and global WAN environments supporting diplomatic or government missions.
• Familiarity with ITIL practices including service catalog design continual service improvement and ITSM implementation (e.g. ServiceNow).
• Prior experience in a SOC team lead or shift lead role with direct responsibility for engineering infrastructure and O&M performance.
• Demonstrated ability to independently manage a team and act in a senior leadership capacity when required.
• Experience maintaining knowledge bases runbook libraries and lessons-learned repositories.
• Familiarity with process automation and scripting tools such as Python PowerShell or Ansible to reduce manual operational workload.