Cybersecurity Operations Supervisor 3rd Shift

SAIC; United States; Remote; USD 120,000 - 150,000; Full time

Benefits offered by this job

Remote work

Job summary

SAIC is seeking a dedicated Cybersecurity Operations Supervisor to support our 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. This role combines hands-on cybersecurity operations with technical leadership and operational oversight, with a remote possibility anywhere in the US.

The supervisor will oversee the 3rd shift (10:00 PM – 8:00 AM EST), mentor analysts, manage incidents, and drive continuous improvement across ESOC operations through collaboration with

Qualifications

• Bachelor's degree required; 5+ years in cybersecurity operations or equivalent.
• Must be a US Citizen.
• Minimum 5 years hands-on cybersecurity operations experience.
• Two of the following certifications: Security+, CySA+, GSEC, GCIH, CEH or related; must obtain one of CISSP/CASP/CISM/GSLC/GSOM within 8 months.

Responsibilities

• Oversee daily Detection & Response operations, ensuring monitoring, triage, investigation and escalation per procedures.
• Investigate security alerts/incidents using SIEM, EDR and other tools; analyze activity and coordinate response.
• Provide technical guidance and mentoring to analysts; support complex investigations and escalation.
• Manage personnel: performance evaluations, coaching, development, attendance, accountability.
• Oversee workloads, prioritization, and staffing to maintain 24/7/365 operation; ensure QA and timely case documentation.
• Monitor performance metrics, identify gaps, and drive improvements within authority.
• Lead onboarding, training, and development of analysts; share knowledge and provide feedback.
• Identify opportunities to improve SOC SOPs, playbooks, and workflows; implement changes.

Skills

Security operations

Team leadership

Incident response

SIEM

EDR

Cloud security

Windows

Linux

Network analysis

Communication

Education

Bachelor's degree

Tools

SIEM tools

EDR tools

AWS

Azure

Windows OS

Linux OS

Job description

SAIC is seeking a dedicated Cybersecurity Operations Supervisor to support our 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. This position combines hands-on cybersecurity operations with technical leadership, personnel management, and operational oversight. For the right candidate, this position may be remote anywhere in the US.

The supervisor will be assigned to 3rd shift, with responsibility for overseeing personnel across both weekly schedules (Sunday - Wednesday and Wednesday - Saturday).

Third shift: 10:00 PM - 8:00 AM EST

The Supervisor is responsible for supporting security investigations, maintaining team performance, developing analysts, and driving continuous improvement across ESOC operations.

Role Overview:

The Cybersecurity Operations Supervisor serves as a hands-on technical and operational leader within the Detection & Response team. This position conducts security investigations, manages assigned security incidents, and provides technical guidance to analysts while overseeing daily cybersecurity operations.

The Supervisor is responsible for managing and developing assigned personnel, ensuring the quality and timeliness of security investigations, maintaining operational readiness, and driving accountability for team performance. The role also supports continuous improvement of SOC processes, procedures, and operational capabilities through collaboration with internal cybersecurity teams and stakeholders.

Job Duties:

• Supervise daily D&R operations, ensuring effective security monitoring, incident triage, investigation and escalation in accordance with established procedures.
• Independently investigate security alerts and incidents using SIEM, EDR, and other security monitoring tools to analyze suspicious activity, determine potential impact, and support appropriate response actions.
• Provide technical guidance and investigative support to cybersecurity analysts, assisting with complex investigations, troubleshooting, and incident escalation.
• Manage assigned personnel, including performance evaluations, coaching, professional development, attendance, and accountability for individual and team performance.
• Oversee operational workloads, investigation prioritization, task assignments, and staffing coverage to maintain effective 24/7/365 security operations.
• Ensure the accuracy, completeness, and timeliness of incident investigations, case documentation, and escalation activities through routine quality assurance and performance reviews.
• Monitor and assess operational performance metrics, identify performance gaps, and implement corrective improvements within established authority.
• Lead the onboarding, training, and development of cybersecurity analyst through technical knowledge sharing, cross-training, and constructive feedback.
• Identify opportunities to improve detection and response workflows, operational procedures, and team effectiveness, recommending and implementing improvements through established approval processes.

Required Education and Experience:

• Bachelor's degree and 5+ years of experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Must be a US Citizen.
• Must have a minimum of 5 years of hands-on experience in cybersecurity operations.
• Must possess at least two of the following certifications: CompTIA Security+, CySA+, GSEC, GCIH, CEH or other related certifications.
• Must obtain one of the following certifications within the first 8 months of start date: CISSP, CASP, CISM, GSLC, or GSOM.
• Demonstrated leadership experience in a cybersecurity operations environment, including coordinating technical workloads, providing guidance and feedback, supporting analyst development, evaluating performance, and addressing operational or performance-related issues.
• Experience assessing security incident severity, determining appropriate escalation paths, and coordinating response activities with relevant stakeholders.
• Advanced experience with security monitoring and incident response technologies, including SIEM, EDR, cloud security platforms, and network analysis tools.
• Working knowledge of Windows, Linux, network security and cloud environments (AWS and Azure), including the ability to analyst relevant security telemetry.
• Understanding of common cyber threats, attacker techniques, and incident response processes.
• Strong communication, organizational, and problem-solving skills, with the ability to provide technical guidance, deliver constructive feedback, and effectively lead personnel in a remote environment.

Preferred Qualifications:

• Previous experience in a formal supervisory or personnel-management role.
• Experience developing, implementing, or improving SOC standard operating procedures (SOPs), incident response playbooks, and operational workflows.
• Experience supporting security operations in large, enterprise or government contracting environments, including geographically distributed or remote teams.