Cyber Defense Operator

Viranim Technical Solutions; San Antonio (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

Viranim Technical Solutions is seeking a Cyber Defense Operator in San Antonio, TX to protect Air Force networks by monitoring, detecting, and mitigating cyber threats in a 24/7/365 environment. You will work with IDS/IPS, SIEM, and threat intelligence to maintain mission readiness and coordinate incident response with AFCERT teams.

The role requires active TS clearance with SCI eligibility, GCFA certification, and hands-on cyber defense experience in SOC environments.

Qualifications

• Active Top Secret clearance with SCI eligibility.
• GCFA certification.
• Experience in cyber defense, network security, or SOC environments.
• Working knowledge of IDS/IPS, SIEM, network protocols and traffic analysis.
• Strong analytical, problem-solving, and decision-making skills.
• Ability to operate effectively in a high-tempo, mission-critical environment.

Responsibilities

• Monitor networks and analyze alerts to defend AF networks.
• Operate IDS/IPS and SIEM to detect and mitigate threats.
• Respond to incidents with containment and remediation.
• Document actions and report on incidents and metrics.
• Support mission planning and coordination.

Skills

Top Secret clearance

GCFA certification

Cyber defense experience

IDS/IPS familiarity

SIEM platforms

Network traffic analysis

Analytical skills

Tools

IDS/IPS systems

SIEM platforms

Network protocols

Job description

Cyber Defense Operator

Location: San Antonio, TX

Position Overview

The Cyber Defense Operator provides mission-critical support to the Air Force Cyber Emergency Response Team (AFCERT) by executing Defensive Cyberspace Operations (DCO) in defense of United States Air Force networks and supported Combatant Commands.

This role is essential to protecting Air Force information systems by identifying, analyzing, and mitigating cyber threats in near real-time. AFCERT operates in a high-tempo 24/7/365 environment with zero tolerance for error, requiring exceptional attention to detail, precision, and responsiveness.

Mission Objectives

• Protect and defend Air Force Networks (AFNet)
• Detect, analyze, and respond to cyber threats and intrusions
• Ensure mission assurance for Air Force and supported Combatant Commands
• Execute network defense operations across NIPRNet and SIPRNet

Key Responsibilities

Defensive Cyberspace Operations (DCO)

• Continuous monitoring and analysis of network traffic, alerts, and events
• Operation and analysis of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
• Detection and mitigation of malicious or anomalous activity
• Incident response, containment, and remediation actions

Cyber Monitoring & Analysis

• Perform near real-time monitoring of security events across Air Force systems
• Review and analyze IDS/IPS alerts, SIEM data, and system logs
• Correlate network activity with intelligence sources to identify threats
• Conduct initial assessments of intrusions including scope, impact, and threat type

Incident Response & Threat Mitigation

• Perform rapid alert triage and determine appropriate response actions
• Isolate, contain, and mitigate cyber threats on Air Force networks
• Execute approved response actions across systems, endpoints, and network components
• Escalate incidents in accordance with established procedures

Event Documentation & Reporting

• Accurately document incidents (who, what, where, when, and why)
• Maintain case records in mission systems for follow-up and investigation
• Generate Mission Reports (MISREPs) and deliver shift turnover briefings
• Track and report performance metrics including incident volume and response effectiveness

Threat Intelligence & Analysis

• Analyze threat intelligence and map adversary activity to frameworks such as MITRE ATT&CK
• Provide feedback to improve detection accuracy and reduce false positives

Training & Continuous Improvement

• Provide on-the-job training (OJT) to team members
• Maintain continuity documentation and operational aids
• Develop and refine tactics, techniques, and procedures (TTPs)
• Recommend improvements to processes, tools, and systems

Mission Operations & Coordination

• Support mission leads and crew commanders with execution and prioritization
• Participate in mission planning, briefings, and debriefings
• Maintain situational awareness and report anomalies impacting mission readiness

Facility & Security Support

• Conduct periodic physical security checks of operational areas
• Initiate emergency procedures when required
• Report facility or operational anomalies to leadership

DCO Functional Area Support

Operators may support one or more of the following areas:

• Network Detection & Monitoring
• Incident Response & Forensics
• Signature Management
• Weapons & Tactics Development
• Content Development
• Training & Curriculum Development
• Standards & Evaluations
• Host-Based Detection
• Operational Processes & PEX Management
• Continuity of Operations (COOP)

Required Qualifications

• Active Top Secret clearance with SCI eligibility
• GCFA certification
• Experience in cyber defense, network security, or Security Operations Center (SOC) environments
• Working knowledge of: IDS/IPS systems, SIEM platforms, network protocols and traffic analysis
• Strong analytical, problem-solving, and decision-making skills
• Ability to operate effectively in a high-tempo, mission-critical environment

Preferred Qualifications

• Familiarity with DoD cyber operations
• Experience supporting Air Force network environments