TECHNICAL LEAD - CYBERSECURITY OPERATIONS

Zermount, Inc.; Arlington (VA); Hybrid; USD 180,000 - 230,000; Full time

Job summary

Zermount, Inc. is seeking a Technical Lead to oversee a large security operations program within a hybrid federal environment.

This role demands hands-on leadership, guiding incident analysis and response, coordinating across teams, and communicating operational risk to program and customer leadership. The successful candidate will mentor analysts and engineers, drive escalation processes, and ensure playbooks and procedures are current, while maintaining strong collaboration with system,

Qualifications

• Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
• Demonstrated ability to resolve undefined, highly complex problems requiring deep analysis and cross-functional collaboration.
• Experience leading technical teams and coordinating high-priority operational work in a large enterprise environment.
• Strong written and verbal communication skills, including the ability to explain technical risk to senior stakeholders.
• Mentoring technical staff and improving team capability.

Responsibilities

• Coordinate daily security operations across monitoring, incident response, threat intel, threat hunting, engineering, and platform-support functions.
• Serve as the technical escalation point for complex, high-impact incidents and service disruptions.
• Review incident scope, severity, evidence, likely cause, affected assets, operational impact, and recommended response actions.
• Guide containment, eradication, recovery, and post-incident improvement activities with stakeholders.
• Track operational risks, dependencies, staffing concerns, service impacts, unresolved issues, and corrective actions.
• Prepare and present operational updates, technical briefings, risk summaries, and decision recommendations.

Skills

Cybersecurity leadership

Incident response

Cross-functional collaboration

Mentoring

Communication skills

Education

Bachelor's degree in cybersecurity, computer science, information systems, engineering, or related field

Job description

Technical Lead - Cybersecurity Operations

Position Overview

The Technical Lead provides hands‑on technical leadership for a large, mission-focused security operations environment. This position coordinates day‑to‑day technical execution, guides complex incident analysis and response, manages technical escalations, supports service continuity, and communicates operational status and risk to program and customer leadership. This is not a purely advisory or management role; the successful candidate must move effectively between executive communication, detailed technical review, operational decision support, and workforce mentoring.

Duties & Responsibilities

• Coordinate daily security operations across monitoring, incident response, threat intelligence, threat hunting, engineering, and platform‑support functions.
• Serve as the technical escalation point for complex, sensitive, or high‑impact incidents and service disruptions.
• Review incident scope, severity, evidence, likely cause, affected assets, operational impact, and recommended response actions.
• Guide containment, eradication, recovery, and post‑incident improvement activities in coordination with system, network, identity, cloud, and security stakeholders.
• Track operational risks, technical dependencies, staffing‑coverage concerns, service impacts, unresolved issues, and corrective actions.
• Prepare and present clear operational updates, technical briefings, risk summaries, and decision recommendations for diverse audiences.
• Lead transition, knowledge‑transfer, continuity, and operational‑readiness activities that preserve critical security functions during change or disruption.
• Maintain and improve operating procedures, escalation paths, contact information, response playbooks, and technical knowledge content.
• Mentor analysts, engineers, administrators, and technical leads; establish consistent technical‑review and quality expectations.
• Identify recurring operational problems and sponsor practical improvements to tools, workflows, detection, response, documentation, and communication.

Qualifications

Minimum Requirements:

• Fifteen or more years of progressively responsible cybersecurity experience, including substantial experience in security operations or incident response.
• Demonstrated ability to resolve undefined, highly complex, multidimensional technical problems requiring deep analysis and cross‑functional collaboration.
• Experience leading technical teams and coordinating high‑priority operational work in a large enterprise environment.
• Strong written and verbal communication skills, including the ability to explain technical risk and response options to senior stakeholders.
• Demonstrated record of mentoring technical staff and improving team capability.

Preferred Qualifications:

• Experience leading or serving as deputy technical lead for a large federal SOC, incident response center, or comparable enterprise security‑operations program.
• Experience in hybrid on‑premises and cloud environments, including AWS, Azure, or Microsoft 365.
• Experience supporting continuity exercises, major incident response, or large operational transitions.
• CISSP and GCIH preferred; GCFA, GREM, GCIA, GNFA, CISM, or PMP are also valuable.
• Working knowledge of widely used incident‑response, security‑control, and federal cybersecurity guidance.

What Success Looks Like

• Operational issues and technical risks are identified early, assigned clear ownership, and driven to evidence‑based closure.
• Complex incidents receive disciplined analysis, clear recommendations, and coordinated response support.
• Technical teams work from current procedures, understand escalation paths, and maintain effective handoffs and backup coverage.
• Program and customer leaders receive concise, decision‑ready information about service health, risk, and required action.

Education and Certifications:

• Minimum: Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field; additional relevant experience may be considered in lieu of a degree.

Clearance Level:

• Secret clearance preferred but not required.

Work Location

• Hybrid federal customer environment. Regular onsite presence and periodic travel between supported operating locations may be required.

Hours of Operation

• Core business hours with availability for after‑hours escalation, on‑call support, exercises, and continuity events.

• Ability to pass a minimum background investigation.