Product Champion – Cyber Operations & Data Analytics

Phoenix Operations Group; Washington (District of Columbia); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Short-term & long-term disability and

401(k) with automatic 10% company"con

Paid time off: 4 weeks annually

Paid holidays: 11 per year

Birthday leave

Referral bonuses

Open-source bonuses

Professional development

Job summary

Phoenix Operations Group seeks a Product Champion with a strong cybersecurity operations, data analytics, and DCO background to support and train cyber teams. You will identify threats, analyze complex data, and translate findings into actionable capabilities for cyber defense operations.

This role blends threat hunting, data analytics, and customer engagement, requiring on-site work in Washington, DC up to four days per week with some travel to a secondary office.

Qualifications

• Active Public Trust clearance or ability to obtain and maintain required U.S. Government clearance.
• U.S. Citizenship required.
• 5+ years in cybersecurity operations or related field with a bachelor's degree in IT/Cybersecurity; or 3+ years with a master's; or 9+ years with a high school diploma.
• Experience supporting DoD customers; experience with US Cyber Command, DISA, DCDC, or Service Cyber Components desirable.
• Ability to present technical analysis to stakeholders with varying levels of technical knowledge.
• Proficient with SQL and KQL.
• Experience with Python; Jupyter notebooks a plus.
• Experience developing dashboards/visualizations with Power BI or Superset.
• Familiarity with Azure, AWS, or GCP.
• Knowledge of threat hunting methodologies.
• Experience with SIEM tools such as Splunk, QRadar, or ELK.
• Familiarity with SOAR platforms such as Sentinel, Cortex, or X-SOAR.
• Experience developing or deploying threat detection signatures.
• Experience collecting and analyzing data from cyber defense resources and open-source intelligence.
• Ability to identify vulnerabilities and attack techniques.
• Ability to interpret detection signatures and formats (Snort, Sigma, YARA, YAML).
• Knowledge of network traffic analysis tools (TCPDump, Wireshark, Zeek).
• Familiarity with MITRE ATT&CK framework, cyber kill chain, and incident response methodologies.
• Understanding of IDS/IPS.
• Strong communication, presentation, organizational, and analytical skills.
• Ability to work independently and in a customer-facing environment.
• Ability to support training and presentations in person and virtually.
• Ability to work on-site in Washington, DC up to four days per week, with occasional travel to secondary office location.

Responsibilities

• Support and promote the use of cyber intelligence, threat awareness, and operational coordination applications.
• Conduct cyber threat hunting across designated big data platforms.
• Analyze threat activity, identify patterns, and communicate findings via presentations and interactive sessions.
• Assist customers with threat hunting operations and analytical requests.
• Work with customers to identify operational requirements, capability gaps, and improvement opportunities.
• Provide recommendations on data enrichment, platform functionality, and user experience.
• Perform QA reviews of data in operational platforms.
• Evaluate new and existing data feeds for relevance, quality, and usability.
• Develop and support data queries, dashboards, visualizations, and analytical products.
• Apply statistical analysis to identify trends in complex datasets.
• Translate analytical findings into customer-facing visualizations and reports.
• Provide real-time customer support during business hours.
• Maintain awareness of emerging threats and communicate findings to stakeholders.
• Develop and maintain documentation for data feeds and deliverables.
• Support demonstrations, briefings, and technical training sessions.
• Perform additional duties as assigned.

Skills

SQL

KQL

Python

Power BI

Superset

Jupyter notebooks

Splunk

QRadar

ELK

SOAR (Sentinel)

Threat hunting

Data analytics

Communication

Presentation

Cloud platforms (Azure, AWS, GCP)

Threat detection signatures

Vulnerability data sources

Snort/Sigma/YAML

TCPDump/Wireshark/Zeek

Education

Bachelor's degree in Information Technology or Cybersecurity

Master's degree in related field

High school diploma or equivalent with 9+ years experience

Tools

Power BI

Superset

Jupyter notebooks

TCPDump

Wireshark

Zeek

Splunk

QRadar

ELK

Sentinel

Cortex

X-SOAR

Job description

Description

Location: Washington, DC
Work Arrangement: On-site up to four days per week
Clearance Requirement: Active Public Trust required; eligible to obtain a Secret clearance
Citizenship: U.S. Citizenship required

Position Overview

We are seeking a Product Champion with a strong background in cybersecurity operations, data analytics, Defensive Cyber Operations (DCO), and network security. The successful candidate will support and train cyber operational teams in the use of intelligence, data analytics, and coordination applications.

This position combines cyber threat hunting, data analysis, customer engagement, and technical training. The Product Champion will help identify emerging threats, analyze complex datasets, communicate findings, and translate operational requirements into actionable capabilities that improve cyber defense operations.

Key Responsibilities

• Support and promote the use of cyber intelligence, threat awareness, and operational coordination applications.
• Conduct cyber threat hunting activities across designated big data platforms.
• Analyze threat activity, identify patterns, and communicate findings through presentations and interactive sessions.
• Assist customers with threat hunting operations and analytical requests.
• Work directly with customers to identify operational requirements, capability gaps, and opportunities for improvement.
• Provide recommendations on data enrichment, platform functionality, and overall user experience.
• Perform quality assurance reviews of data maintained within operational platforms.
• Evaluate new and existing data feeds to determine relevance, quality, and usability.
• Develop and support data queries, dashboards, visualizations, and analytical products.
• Apply statistical analysis and modeling techniques to identify trends and uncover patterns in complex datasets.
• Translate analytical findings into clear, customer-facing visualizations and reports.
• Provide real-time customer support during normal business hours.
• Maintain awareness of emerging cyber threats and communicate relevant findings to impacted stakeholders.
• Develop and maintain documentation for data feeds, analytical products, and deliverables.
• Support demonstrations, customer briefings, and technical training sessions.
• Perform additional duties as assigned.

Required Qualifications

• Active Public Trust clearance or the ability to obtain and maintain the required U.S. Government clearance.
• U.S. Citizenship required.
• Five or more years of experience in cybersecurity operations or a related technical field with a bachelor's degree in Information Technology, Cybersecurity, or a related discipline; alternatively:
  • Three or more years of relevant experience with a related master's degree; or
  • Nine or more years of relevant experience with a high school diploma or equivalent.
• Experience supporting Department of Defense customers; experience supporting U.S. Cyber Command, DISA, DCDC, or Service Cyber Components is highly desirable.
• Ability to present technical analysis and findings to stakeholders with varying levels of technical knowledge.
• Proficiency with query languages such as SQL and Kusto Query Language (KQL).
• Experience with Python; familiarity with Jupyter notebooks is a plus.
• Experience developing dashboards and visualizations using tools such as Power BI or Superset.
• Familiarity with cloud environments, including Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
• Knowledge of cyber threat hunting methodologies and techniques.
• Experience with Security Information and Event Management (SIEM) tools such as Splunk, QRadar, or ELK.
• Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms such as Sentinel, Cortex, or X-SOAR.
• Experience developing or deploying threat detection signatures.
• Experience collecting and analyzing data from cyber defense resources, including vulnerability databases and open-source intelligence.
• Ability to identify and categorize vulnerabilities and associated attack techniques.
• Ability to interpret detection signatures and formats such as Snort, Sigma, YARA, and YAML.
• Knowledge of network traffic analysis tools and methods, including TCPDump, Wireshark, and Zeek.
• Familiarity with the MITRE ATT&CK framework, cyber attack lifecycle, and incident response methodologies.
• Understanding of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).
• Strong communication, presentation, organizational, and analytical skills.
• Ability to work independently and collaboratively in a customer-facing environment.
• Ability to support training and presentations both in person and virtually.
• Ability to work on-site in Washington, DC up to four days per week, with occasional travel to a secondary office location.

Preferred Qualifications

• Active Secret security clearance.
• Industry-recognized cybersecurity certifications such as Security+, CySA+, GCIH, GNFA, GCFA, or Data+.
• Previous experience supporting a Department of Defense Security Operations Center (SOC).
• Familiarity with big data platforms and data lake architectures.
• Experience supporting cyber defense, threat intelligence, or operational analytics environments.

Work Environment

This is a customer-facing position requiring regular on-site support in Washington, DC, up to four days per week. The role may require occasional travel to another company office location and flexibility to support customer requirements, briefings, and training events.

Benefits Offered

• Medical, dental, and vision insurance: 100% company-paid premiums.
• Short-term disability, long-term disability, and life insurance: Fully company paid.
• 401(k): Automatic 10% company contribution; no matching required.
• Paid time off: Four weeks annually.
• Paid holidays: Eleven per year.
• Birthday leave: Your birthday off with pay.
• Referral bonuses: Upfront and annually recurring bonuses.
• Open-source bonuses: Rewards for contributing to our GitHub projects.
• Professional development: Paid training, certifications, and enrichment opportunities.

About Phoenix Operations Group

Phoenix Operations Group delivers advanced engineering services that protect and strengthen our nation’s cyber resources. As a small company, we invest in innovation and employee development to solve challenging customer problems. Our capabilities span batch and streaming Big Data analytics, cloud infrastructure, multi-INT visualization, and enterprise architecture. We support All-Source, Financial, and CND operational missions and serve as Product Owners for our open-source research initiatives.

Learn more at www.phoenix-opsgroup.com.

Equal Employment Opportunity

Employment decisions at Phoenix Operations Group are based on qualifications, merit, and business needs. We provide equal employment opportunities without discrimination based on race, religion, color, sex, gender, gender identity, sexual orientation, age, non-disqualifying physical or mental disability, national origin, veteran status, or any other legally protected basis.