Defensive Cyber Ops Lead

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.We are seeking an exceptional Defensive Cyber Operations Lead to manage daily cyber defense tasking and operational tempo, serving as the primary liaison between contractor personnel and mission counterparts to ensure seamless coordination and mission alignment. This role requires a proven senior-level technical authority who can match personnel skills and certifications to operational requirements and mission priorities while managing complex, large-scale operations supporting critical national security missions.Nightwing delivers end-to-end secure IT services leveraging deep experience in Offensive Cyber Operations (OCO), Defensive Cyber Operations (DCO), Cyber Vulnerability Assessments (CVAs), and systems integration. As Defensive Cyber Operations Lead, you will translate operational requirements into actionable defensive cyber missions, lead threat detection and response operations, and ensure our cyber defense capabilities remain operationally effective in dynamic threat environments.You will be responsible for maintaining operational readiness of cyber defense teams operating within accredited environments, ensuring compliance with DoD Information Assurance (IA) requirements, and supporting defensive cyber operations across systems with Authority to Operate (ATO). This includes leading threat hunting activities, incident response operations, and continuous monitoring that meet operational security standards and mission requirements.This is a high-visibility, operationally critical leadership position requiring an individual who can lead cyber defense teams supporting programs with 50+ FTEs, navigate 24/7/365 operational environments in mission settings, and drive organizational success through operational excellence, mission-focused leadership, and tactical proficiency. You will be accountable for the operational readiness and defensive posture of teams supporting critical Intelligence Community operations.Key ResponsibilitiesDefensive Cyber Operations LeadershipServe as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annuallyManage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operationsServe as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignmentLead threat detection, incident response, and threat hunting operations across enterprise-scale networksOversee cyber defense missions including intrusion detection, malware analysis, and network defense operationsDirect Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilitiesDrive tactical and operational decisions during cyber incidents and defensive operationsPersonnel & Readiness ManagementMatch personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operatorsMaintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levelsEnsure team maintains readiness to support dynamic threat environments and surge requirements with minimal noticeCoordinate personnel scheduling and duty assignments across multiple operational shifts and mission setsConduct operational readiness assessments and capability gap analysisSupport technical hiring, training, and professional development to maintain mission-critical capabilitiesFoster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordinationMission Coordination & Stakeholder EngagementInterface directly with military cyber operations teams, intelligence analysts, and mission partners on operational mattersEnsure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholdersProvide situational awareness and operational status updates to program leadership and customersSupport planning and execution of defensive cyber operations including coordinated hunts and incident responsePresent operational updates and threat briefings to C-suite and senior government leadershipBuild and maintain strong operational relationships that enhance mission effectiveness and information sharingCoordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterpriseOperational Performance & Metrics ManagementTrack and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectivenessGenerate regular operational reports on threat activity, incident response performance, and defensive postureIdentify operational trends through threat intelligence analysis and implement proactive defensive measuresSupport after-action reviews (AARs) and lessons learned processes to improve operational effectivenessMaintain operational documentation including standard operating procedures (SOPs), playbooks, and run booksProvide executive-level reporting on operational readiness and threat landscapeEnsure Service Level Agreement (SLA) compliance for detection, response, and escalation timelinesCapability Development & TrainingAssess and develop team capabilities to meet evolving threat landscape and mission requirementsRecommend training and professional development opportunities including certifications, technical training, and operational exercisesSupport integration of new tools, techniques, and procedures (TTPs) into defensive operationsLead operational training exercises and tabletop exercises to maintain team proficiencyFoster culture of continuous learning, threat intelligence sharing, and operational innovationDevelop and maintain threat-informed defensive strategies and operational conceptsTechnical Operations & System IntegrationOversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber toolsEnsure integration and operational effectiveness of threat detection, hunting, and response technologiesSupport tuning and optimization of detection content, correlation rules, and alert workflowsCoordinate with engineering teams on tool deployment, configuration, and operational supportMaintain situational awareness of network architecture, critical assets, and defensive coverageSupport continuous monitoring requirements for accredited systems and compliance with IA standardsOperational Risk Management & Mission AssuranceIdentify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operationsDevelop and implement tactical response procedures and escalation protocols for cyber incidentsEnsure operational continuity during high-threat periods, system outages, or personnel transitionsNavigate operational constraints while maintaining unwavering mission focus and defensive postureSupport crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacksBalance operational tempo with sustainable operations and team well-being during extended operationsRequired QualificationsEducation & CertificationBachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM fieldSecurity+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certificationExperienceDefensive Cyber Operations Leadership (One of the following):10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missionsDomain Experience (One of the following):5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus5-8 years detection engineering and automation experience5-8 years cyber operations or threat hunting with Intelligence Community customersTechnical KnowledgeDeep understanding of defensive cyber operations, threat detection methodologies, and incident response processesDemonstrated experience with programs of similar size and scope supporting Intelligence Community missionsExtensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groupsStrong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environmentsExperience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologiesWorking knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK frameworkFamiliarity with network security monitoring, log analysis, and forensic investigation techniquesUnderstanding of Cyber Operations and partner cyber mission teamsLeadership & Stakeholder ManagementExceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditionsDemonstrated success in mission environments requiring rapid operational decision-making and tactical leadershipTrack record of building and maintaining high-performing cyber defense teams with strong retention and moraleStrong operational presence with ability to brief senior military and civilian leadership during incidentsExperience managing in military or intelligence community operational environments with complex reporting structuresProven ability to coordinate across organizational boundaries including military, intelligence, and contractor teamsPreferred QualificationsExperience within Intelligence Community and Cyber mission partner environmentsAdvanced GIAC certifications: GCIH, GCIA, GCFA, GNFA, GREM, or equivalent advanced certificationsMultiple advanced certifications: CISSP, CISM, GCTI, CEH, or offensive security certificationsExperience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missionsBackground in threat intelligence analysis, malware reverse engineering, or advanced threat huntingExperience with cloud security operations (AWS, Azure, GCP) and hybrid network defensePrior experience managing 24/7/365 SOC operations with multi-tiered support structuresExperience supporting classified programs at TS/SCI level with special access programs (SAP)Track record of operational innovation improving detection, response, or threat hunting capabilitiesKey AttributesMission-first operational leader with relentless focus on defensive effectiveness and team readinessTactical and strategic thinker who can balance immediate threats with long-term defensive postureCalm under pressure with proven ability to lead during active incidents, breaches, or complex investigationsEffective communicator across tactical, operational, and strategic levelsTeam builder with mentorship focus and commitment to developing next-generation cyber defendersDecisive operational commander who thrives in high-pressure environmentsThreat-focused leader who stays current on adversary TTPs and emerging threatsCollaborative partner able to coordinate across military, intelligence, and contractor organizationsTechnically credible with hands-on experience that earns respect from operational teamsEthical leader committed to responsible cyber operations and mission integritySuccess MetricsThreat detection effectiveness with measurable improvement in detection rates and reduction in dwell timeIncident response performance meeting or exceeding MTTD and MTTR targetsOperational readiness with teams maintaining required certifications, training, and capability levelsCustomer satisfaction with defensive cyber operations and incident response (CPARS ratings of Very Good or Exceptional)Team performance including retention, morale, proficiency assessments, and operational tempo sustainabilityMission impact through successful threat detection, incident containment, and adversary disruptionInnovation adoption with measurable improvement in defensive capabilities through new tools and techniquesSLA compliance consistently achieving contractual performance targets for detection and responseWhy NightwingLead mission-critical maintenance operations directly supporting Intelligence Community operations and national security objectivesExercise full operational authority with meaningful impact on system availability, mission effectiveness, and operational readinessBuild and lead high-performing maintenance teams of talented professionals supporting cutting-edge cyber and intelligence systemsPartner directly with senior government customers in the Intelligence Community on programs of strategic importanceOperate in environments where your operational leadership and decisions truly matter to mission successCompetitive compensation with performance-based incentives tied to operational performance and SLA achievementOpportunity to work on challenging operational problems supporting critical national security missionsAt Nightwing, we value collaboration and teamwork. You'll have the opportunity to work alongside talented individuals who are passionate about what they do. Together, we'll leverage our collective expertise to drive innovation, solve complex problems, and deliver exceptional results for our clients.Thank you for considering joining us as we embark on this new journey and shape the future of cybersecurity and intelligence together as part of the Nightwing team.Salary & BenefitsThe salary associated with this position ($147,000-$296,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise. Compensation will be determined based on these factors to ensure alignment with skills, responsibilities, and market standards.Nightwingoffers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.Nightwing is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.SummaryLocation: Sterling, VAType: Full time