Remote Cloud Threat & Incident Response Lead

Booz Allen Hamilton; McLean (VA); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton is seeking a Cybersecurity Cloud Ops Threat and Incident Response Lead to defend an AWS GovCloud platform powering critical workloads. You will drive detection, response, and automation while coordinating across cyber, platform, and governance teams in a DoD-focused environment.

The role requires hands-on incident response, cloud-security operations, and SIEM proficiency. You will participate in on-call rotations and contribute to continuous monitoring and reporting for

Qualifications

• 3+ years operating cloud security services in production (AWS Security Hub, GuardDuty, Inspector, CloudTrail).
• 3+ years of experience with a SIEM such as Splunk, including detection tuning and alert triage.
• Experience executing incident response runbooks and leading incident calls.
• Experience automating detection, triage, or response with scripting or AI-enabled tooling.
• Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements.
• Ability to work across cyber, platform, and governance teams in fast-moving mission environments.
• Secret clearance.
• Bachelor's degree in a Cybersecurity, Computer Science, or Engineering field and 5+ years of experience in security operations, incident response, or threat detection, or 9+ years of experience in security operations, incident response, or threat detection in lieu of a degree.

Responsibilities

• Own detection and response on the cloud platform.
• Execute and improve incident response runbooks and on-call rotations.
• Provide continuous monitoring evidence for authorization and compliance.

Skills

Cloud security operations

Incident response leadership

Scripting / AI tooling

Cross-team collaboration

Security operations experience

Secret clearance

Education

Bachelor's degree in Cybersecurity/CS/Engineering or related field

Tools

AWS Security Hub

GuardDuty

Inspector

CloudTrail

Splunk

Job description

Booz Allen Hamilton is seeking a Cybersecurity Cloud Ops Threat and Incident Response Lead to defend an AWS GovCloud platform powering critical workloads. You will drive detection, response, and automation while coordinating across cyber, platform, and governance teams in a DoD-focused environment.

The role requires hands-on incident response, cloud-security operations, and SIEM proficiency. You will participate in on-call rotations and contribute to continuous monitoring and reporting for