Cybersecurity Operations Team Lead

GCyber; Illinois; On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Paid Leave and PTO

Parental Leave

401(k) Matching

Health/Dental/Vision Insurance

Professional Development

Job summary

GCyber is seeking a Cybersecurity Operations Team Lead to run a 24/7 security operations center for a large DoD-related agency in Illinois. You will oversee monitoring, incident response, and forensics, ensuring continuous coverage and timely decisions.

You will mentor analysts, design shift coverage, and drive process improvements with metrics-based performance reviews. Strong DoD incident handling knowledge is essential.

Qualifications

• 7+ years in security analytics, incident response, threat analysis or security engineering.
• Bachelor's degree; 4 additional years of experience may substitute.
• CISSP and GCIH or GCIA certifications.
• Active TS/SCI clearance; complete required tool training before system access.

Responsibilities

• Lead a 24/7 monitoring, incident response, and forensics team.
• Escalation point for all shifts.
• Manage incident declaration, escalation, and reporting to USCYBERCOM and JFHQ-DODIN.
• Maintain watch schedules, leave coverage, and staffing for continuous operations.
• Lead shift briefings, handoffs, and reviews; resolve recurring issues.
• Analyze triage, detection, and response metrics; implement improvements.
• Approve automated response actions under tiered approvals.
• Develop analysts through mentoring and performance feedback.

Skills

24/7 SOC

Incident leadership

Decision making under pressure

Mentoring staff

SIEM/EDR investigations

Education

Bachelor's degree

Tools

SIEM

EDR

Job description

GCyber is seeking a Cybersecurity Operations Team Lead to support a large Department of War agency. You will lead a 24/7 cyber operations center responsible for monitoring, incident response, and forensics. You will maintain shift coverage, guide incident decisions, and improve response through consistent procedures and performance analysis.

As the Cybersecurity Operations Team Lead, you will:

• Lead a team responsible for 24/7 monitoring, incident response, and forensics.
• Serve as the escalation point for all shifts.
• Manage incident declaration, escalation, and timely reporting to USCYBERCOM and JFHQ-DODIN.
• Manage watch schedules, leave coverage, and staffing to maintain continuous operations.
• Lead shift briefings, handoffs, and operational reviews, and resolve recurring performance issues.
• Analyze triage, detection, and response metrics and implement measurable improvements.
• Approve automated response actions under the tiered approval model.
• Develop analysts for increased responsibility through mentoring and performance feedback.

Minimum Requirements and Experience

• 7+ years of experience, including 5+ in security analytics, incident response, threat analysis or security engineering.
• Bachelor's degree (4 additional years of experience may substitute).
• CISSP, and GCIH or GCIA.
• Active TS/SCI clearance; complete required tool training before system access.

Required Knowledge and Skills

• Running a 24/7 SOC: shift design, escalation, quality control and handoffs.
• DoD incident handling (CJCSM 6510.01B) and reporting timelines.
• Hands-on SIEM and EDR investigation experience sufficient to guide analysts through complex events.
• Calm decision-making during major incidents.
• Coaching analysts and building career paths.

Preferred Qualifications

• Prior experience leading a DoD 24/7 security operations center.

Our Benefits

GCyber is committed to the well-being and development of every employee. Our benefits are designed to support your personal and professional goals, from health and wellness programs to retirement savings and career development opportunities. Highlights include:

• 26 Days of Paid Leave + Annual PTO Increase
• An extra day of paid leave for every year of employment with GCyber
• Paid Parental Leave
• Additional Leave Allowances for Military Duty, Jury Duty, and Bereavement Leave
• 401(k) Matching
• 100% Company-funded Disability Insurance
• 90% Company-Funded Health, Dental, and Vision Insurance, with contributions to insurance benefits for spouses, children, and family members
• Training and Professional Development Plans
• Commuter Benefits Plan
• Parking and Transportation Allowance

Equal Opportunity Employer

GCyber is an Equal Opportunity Employer. This means you don't have to worry about whether your application process will be fair. We consider all applicants without regard to race, color, religion, age, ancestry, ethnicity, gender, gender identity, gender expression, sexual orientation, veteran status, or disability.

Stay in Touch

For future job notifications please follow GCyber on LinkedIn. https://linkedin.com/company/gcyber