Evening Security Operations Lead – Incident Response

Knox Systems, Inc.; Arlington (VA); On-site; USD 125,000 - 160,000; Full time

Benefits offered by this job

Medical benefits

Dental & Vision coverage

401k with employer match

Life & Disability insurance

Job summary

KnoxKnox is seeking a Senior Security Operations leader to oversee an evening shift (14:00–22:00), drive incident response, and set escalation criteria across teams. You will mentor analysts, perform root-cause analysis, and contribute to FedRAMP evidence packages.

The role requires 5+ years in security operations, a track record of developing people, and strong cloud security monitoring and incident response capabilities. A degree is not required, but security credentials are valued.

Qualifications

• Five or more years in security operations or equivalent.
• Track record of developing team members and promoting growth.
• Strong grounding in cloud security monitoring and incident response.

Responsibilities

• Lead the evening shift as the senior person on the floor from 14:00 to 22:00.
• Set escalation criteria and determine what wakes a manager vs. what the team handles independently.
• Perform root cause analysis on incidents reaching containment and update runbooks to prevent recurrence.
• Maintain shift logs, handovers, and queue health across all shifts.
• Develop Tier 1 and Tier 2 analysts and assess readiness for promotion.
• Represent the team in incident reviews and FedRAMP evidence work.

Skills

Security operations

People development

Cloud security monitoring

Incident response

Leadership

Tools

FedRAMP controls

Incident response tools

Job description

KnoxKnox is seeking a Senior Security Operations leader to oversee an evening shift (14:00–22:00), drive incident response, and set escalation criteria across teams. You will mentor analysts, perform root-cause analysis, and contribute to FedRAMP evidence packages.

The role requires 5+ years in security operations, a track record of developing people, and strong cloud security monitoring and incident response capabilities. A degree is not required, but security credentials are valued.