Cloud Threat & Incident Response Lead — AWS GovCloud

Booz Allen; McLean (VA); On-site; USD 87,000 - 198,000; Full time

Benefits offered by this job

Health insurance

Life insurance

Disability benefits

Retirement plan

Paid leave

Tuition assistance

Work-life programs

Job summary

Booz Allen is seeking a Cybersecurity Cloud Ops Threat and Incident Response Lead to defend a cloud platform built to DoD IL5 standards. You’ll own detection and response, leverage AWS GovCloud, Splunk, GuardDuty, and Tenable, and drive automation to shorten incident lifecycle.

You’ll work across cyber, platform, and governance teams to evaluate risk, refine runbooks, and ensure timely reporting within required windows. A Secret clearance is required.

Qualifications

• 3+ years operating cloud security services in production, including AWS Security Hub, GuardDuty, Inspector, and CloudTrail.
• 3+ years of experience with a SIEM such as Splunk, including detection tuning and alert triage.
• Experience executing incident response runbooks and leading incident calls.
• Experience automating detection, triage, or response with scripting or AI-enabled tooling.
• Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements.
• Ability to work across cyber, platform, and governance teams in fast-moving mission environments.
• Secret clearance.
• Bachelor's degree in a Cybersecurity, Computer Science, or Engineering field and 5+ years of experience in security operations, incident response, or threat detection, or 9+ years of experience in security operations, incident response, or threat detection in lieu of a degree.

Responsibilities

• Own detection and response on the platform and improve incident response runbooks for timely reporting.
• Operate and defend an AWS GovCloud platform and AI workloads, integrating Splunk, GuardDuty, Inspector, and Tenable.
• Be on the on-call rotation and produce continuous monitoring evidence for authorization.
• Collaborate with platform, cyber, and governance teams to assess risk and recommend durable security improvements.
• Maintain production security posture and adapt to changing threat landscapes.

Skills

Cloud security

Splunk SIEM

Incident response

Automation scripting

NIST SP 800-53

Security clearance

Security operations

Education

Bachelor's degree in Cybersecurity/CS/Engineering

Tools

AWS GovCloud

Kubernetes (EKS)

Tenable ACAS

JFrog Xray

Trellix ePO

Amazon Security Lake

Agentic AI

Job description

Booz Allen is seeking a Cybersecurity Cloud Ops Threat and Incident Response Lead to defend a cloud platform built to DoD IL5 standards. You’ll own detection and response, leverage AWS GovCloud, Splunk, GuardDuty, and Tenable, and drive automation to shorten incident lifecycle.

You’ll work across cyber, platform, and governance teams to evaluate risk, refine runbooks, and ensure timely reporting within required windows. A Secret clearance is required.