Cybersecurity Operations Specialist

MANTECH; McLean (VA); On-site; USD 120,000 - 200,000; Full time

Job summary

MANTECH in McLean, VA seeks a Cybersecurity Operations Specialist to lead incident response and run security operations across multi-cloud environments. You will balance hands-on investigations with governance, reporting, and contract compliance while guiding a team of security professionals.

Responsibilities span escalation, forensics, detection automation, exercises, and leadership oversight. A TS/SCI with poly is required for clearance, with extensive experience in cyber defense and program

Qualifications

• High School Diploma and 10+ years of cybersecurity experience.
• 5+ years of experience in cyber defense operations, incident response, or CSOC environments.
• 3+ years of experience in management or team leadership overseeing technical staff, schedules, and administrative deliverables.
• Experience leading complex incident response investigations across multi-cloud and enterprise architectures.

Responsibilities

• Lead end-to-end incident investigations across cloud and enterprise architectures as tier-3 escalation lead for complex threats.
• Architect automated playbooks, integrate threat intelligence, and leverage AI within SIEM/EDR to improve detection and workflows.
• Design and execute readiness exercises, threat hunting, and maintain toolsets and failover procedures for alternate-site operations.

Skills

Incident response

Forensic analysis

Threat detection

Automation engineering

Leadership

RBAC governance

Education

High School Diploma

Tools

SIEM

EDR

Cloud security

Compliance

Job description

MANTECH

McLean, VA 22101

MANTECH seeks a motivated, career and customer-oriented Cybersecurity Operations Specialist to join our team in McLean, VA. In this role you will serve as the primary technical expert and operational lead for cybersecurity incident response. This role balances direct technical execution with administrative and managerial oversight, dividing focus between leading complex investigations, engineering security workflows, and managing personnel, operational reporting, and contract compliance.

Responsibilities include, but are not limited to:

Technical Operations & Engineering

• Incident Escalation & Forensic Analysis: Lead end-to-end incident investigations across cloud and enterprise architectures, acting as the tier-3 escalation lead for complex, high-impact, and multi-vector security threats.
• Detection & Automation Engineering: Architect automated playbooks, integrate threat intelligence, and leverage AI capabilities within SIEM/EDR tools to improve detection and streamline analyst workflows.
• Readiness & Exercise Execution: Design and execute exercises, perform threat hunting, and maintain the technical toolsets and failover procedures required for alternate-site operations.

Management & Administrative Oversight

• Personnel Leadership & Staffing: Manage shift personnel, conduct performance evaluations and 1-on-1 coaching, oversee onboarding, and maintain rosters to ensure continuous operational coverage.
• Governance & Access Control: Provision and audit role-based access control (RBAC), enforce documentation standards, and manage emergency continuity and relocation protocols.
• Reporting & Leadership Coordination: Own operational KPIs, deliver executive reporting on threat trends and program health, and align workflows with contract and government leadership.

Minimum Qualifications:

• High School Diploma and 10+ years of cybersecurity experience.
• 5+ years of experience in cyber defense operations, incident response, or CSOC environments.
• 3+ yearsof experience in management or team leadership overseeing technical staff, schedules, and administrative deliverables.
• Experience leading complex incident response investigations across multi-cloud and enterprise architectures.

Preferred Qualifications:

• 5+ years supporting large, classified cybersecurity contracts within the IC
• GIAC GCIH, GCFA, GNFA, CCSP, or CISSP certification(s).
• Project Management Professional (PMP) or ITIL certification(s).

Clearance Requirements: An active/current TS/SCI with Polygraph is required for this position
Physical Requirements: Must be able to remain in a stationary position 50% of the time

Application Questions

Please select the highest level of security clearance you possess.