Cybersecurity Operations Specialist

Cybersecurity Jobs; McLean (VA); On-site; USD 135,000 - 170,000; Full time

Job summary

MANTECH is seeking a Cybersecurity Operations Specialist in McLean, VA to serve as the primary technical expert and operations lead for incident response. The role blends deep investigations with security workflow engineering, management oversight, and contract compliance across enterprise and cloud environments.

You will act as the tier-3 escalation point for complex threats, drive investigations end-to-end, and push automation, exercises, threat hunting, and robust toolsets to improve

Qualifications

• Minimum High School Diploma required.
• 10+ years of cybersecurity experience.
• 5+ years in cyber defense operations, incident response, or CSOC environments.
• 3+ years managing or leading technical staff.
• Experience leading complex incident response investigations across multi-cloud and enterprise architectures.
• GIAC GCIH, GCFA, GNFA, CCSP, or CISSP certifications.
• PMI PMP or ITIL certifications.
• Active/current TS/SCI with Polygraph required.

Responsibilities

• Lead tier-3 escalation for complex, high-impact security threats and investigations.
• Architect automated playbooks and integrate threat intelligence to improve detection and analyst workflows.
• Design and execute exercises, threat hunting, and maintain tools/templates for failover and alternate-site operations.
• Manage shift personnel, performance evaluations, onboarding, and rosters for continuous coverage.
• Provision and audit RBAC, enforce documentation standards, and manage continuity and relocation protocols.
• Own operational KPIs and deliver executive reporting on threat trends and program health.

Skills

Incident response

Leadership

Automation

Threat hunting

Multi-cloud

SIEM/EDR

Team management

Education

High School Diploma

GIAC GCIH, GCFA, GNFA, CCSP, or CISSP

TS/SCI with Polygraph

PMP or ITIL certification

Tools

SIEM/EDR

RBAC

Job description

MANTECH is hiring a Cybersecurity Operations Specialist in McLean, VA to support cybersecurity incident response as a primary technical expert and operations lead. This onsite role blends deep incident investigation with security workflow engineering, along with management oversight, operational reporting, and contract compliance across enterprise and cloud environments.

Role Focus

You will serve as the tier-3 escalation point for complex, high-impact, multi-vector threats, driving investigations end-to-end and shaping how analysts and tooling respond to emerging risk. The position also emphasizes automation and operational readiness, including exercises, threat hunting, and maintaining technical toolsets and failover procedures for alternate-site operations.

Responsibilities

• Lead end-to-end incident investigations across cloud and enterprise architectures as the tier-3 escalation lead for complex, high-impact, multi-vector security threats.
• Architect automated playbooks, integrate threat intelligence, and leverage AI capabilities within SIEM/EDR tools to improve detection and streamline analyst workflows.
• Design and execute exercises, perform threat hunting, and maintain technical toolsets and failover procedures for alternate-site operations.
• Manage shift personnel, conduct performance evaluations and 1-on-1 coaching, oversee onboarding, and maintain rosters to ensure continuous operational coverage.
• Provision and audit role-based access control (RBAC), enforce documentation standards, and manage emergency continuity and relocation protocols.
• Own operational KPIs, deliver executive reporting on threat trends and program health, and align workflows with contract and government leadership.

Requirements

• High School Diploma
• 10+ years of cybersecurity experience
• 5+ years in cyber defense operations, incident response, or CSOC environments
• 3+ years managing or leading technical staff, including oversight of schedules and administrative deliverables
• Experience leading complex incident response investigations across multi-cloud and enterprise architectures
• GIAC GCIH, GCFA, GNFA, CCSP, or CISSP certification(s)
• Project Management Professional (PMP) or ITIL certification(s)
• Active/current TS/SCI with Polygraph is required
• Must be able to remain in a stationary position 50% of the time

Technologies

• SIEM/EDR
• RBAC
• AI