Security Operations Manager

Summary Security Operations Manager Tysons Corner, VA Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer’s core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level! Astraeus Operations (AO) is an SBA-certified 8(a) Small Disadvantaged Business (SBD) subsidiary of the Chenega Corporation, an Alaska Native Corporation (ANC). We are a small business with large business capabilities due to our shared-services Program Management Office (PMO) structure. Through our ISO 9001:2015 certification, we can accomplish the full range of contract services including financial, human capital, recruiting, procurement, security, and technical resources to achieve contract mission requirements. As a result, our ‘small business – big capability’ dynamic benefits our clients through consistent communications and straight-lined workflows, ensuring our accountability to our clients for successful mission fulfillment. In plain terms, our clients gain a team that’s on the same page to achieve and support the client’s mission. We vigorously respond to clients’ requests without additional costs, delays, or inefficiencies that are often experienced with larger, more cumbersome organizations. AO is eligible for sole source, direct awards up to $100M for DOD and up to $25M for other federal agencies, without J&A. Astraeus is the easy button for a client wishing to take advantage of the rapid, agile, and flexible sole source procurement option. Combined with the shared PMO services, Astraeus offers highly competitive labor rates to fulfill day-to-day contract operations. The SecOps Manager serves as an on-floor subject matter expert supporting Google Public Sector’s (GPS) 24/7/365 Tier 1 security operations in sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across Google sovereign infrastructure and air-gapped offerings. The manager leads shift operations, coaches analysts, pre-screens technical escalations to Google SecOps engineering, and drives security playbook and alert-tuning improvements while ensuring high-confidence triage, timely responses, and continued partner ownership of incidents. Responsibilities Lead on-floor Tier 1 security operations and coach analysts in monitoring GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools, Splunk, ELK, designated SIEM systems, and EDR tools. Oversee initial GPS customer and incident-reporting support, including email and support portals. Ensure alerts are acknowledged within 5 minutes of creation and receive a First Meaningful Response (FMR) within 15 minutes for High/Critical alerts and 25 minutes for all others. Guide incident-detail collection, severity categorization, event enrichment, and correlation. Validate evidence and disposition justifications for high-confidence triage and ensure all true positives are escalated to the appropriate Google SecOps representative per procedures and runbooks. Ensure partner ownership of ServiceNow incidents, investigations, customer updates, follow-on actions, and required government incident-report drafts continues during Google technical consults. Transfer ownership only with explicit Google manager approval; coordinate incident response and required EDR tooling with Google SecOps. Pre-screen technical consults during core hours using analyst summaries of Observed Activity, Playbooks/Queries Run, IOCs, and Proposed Disposition. Review off-hours pre-screening by designated senior analysts the next business day. Ensure active High/Critical handoffs include Current Status, Analysis Completed, and Next Steps and are immediately accepted by the incoming shift without rejection. Drive playbook development, validation, and continuous improvement with engineering teams. Track noisy alerts and broken playbooks, coach analysts on appropriate responses, and partner on SIEM detection tuning. Provide hands-on-keyboard accreditation support to validate playbooks, runbooks, IT infrastructure, and Data Center operations. Coordinate operational coverage with the on-shift team to maintain at least two active personnel and at least one FTE in each occupied SecOps room, including holidays, PTO, training, and severe or inclement weather. Ensure SecOps calls are answered and routed, on-call guidance is sought as needed, and virtual communications receive responses within 15 minutes. Serve as live Queue Manager or ensure a designated senior on-shift analyst fills the role each shift. Monitor alert timers and intervene at least 5 minutes before response targets expire so no SLA breach goes unnoticed. Attend requested customer situational awareness calls and ensure noteworthy information and tasking are relayed through designated channels within 1 hour, using appropriate unclassified wording when required. Coordinate weekly activity reporting due Friday by 15:00 EDT, covering alert response SLA compliance, triage dispositions, playbooks validated/updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing. Provide operational inputs on hours incurred, upcoming-month support, and active issues/blockers for monthly financial status reports due by the following month’s 10th. Other duties as assigned. Qualifications 5+ years of experience in security operations (SOC) or incident response, including leading shift operations, pre-screening technical escalations, coaching security analysts, and partnering with engineering teams on SIEM detection tuning and playbook development. Strong hands-on experience with SIEM, IDS, EDR, and case management or ticketing tools. Technical experience supporting Windows and Linux operating systems, networking infrastructure, scripting, and security application troubleshooting. Possess and maintain an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification before starting billable work (e.g., CySA+, GCIA, GCIH, CEH, or CISSP). Successfully complete Google’s extended workforce onboarding process and maintain required government-contract compliance, including mandatory training. Active TS/SCI with Full Scope Polygraph Successfully pass background and drug screening Preferred Qualifications Bachelor’s degree in cybersecurity or computer science, or equivalent practical experience. Experience in a dedicated SOC, including event analysis using Splunk, ELK, or other SIEM systems. Hands-on security detection development and alert tuning in partnership with Tier 2 and Tier 3 engineering teams, supporting continuous improvement of SOC playbooks. Experience compiling threat reports that translate complex indicators of compromise (IOCs) into clear narrative overviews for customer and technical audiences. Advanced understanding of LAN/WAN topologies, Google Cloud Platform, Kubernetes, and air-gapped computing environments. Experience operating in classified SCIF environments, handling sensitive or classified data, or supporting cloud environments. Elastic Certified SIEM Analyst or Splunk Core Certified User certification. Knowledge, Skills and Abilities General knowledge of network analysis, vulnerability scanning (e.g., Nessus), security hardening best practices (e.g., DISA STIG), and vulnerability landscapes (e.g., OWASP Top 10). Foundational understanding of LAN/WAN topologies, Kubernetes, and air-gapped computing environments. Clear technical and customer communication; ability to explain incident findings, review diagnostic summaries and reports, and provide actionable coaching to analysts. Ability to lead collaboratively in classified, mission-critical environments, safeguard sensitive information, and reinforce security procedures, approved runbooks, and escalation protocols. Sound operational judgment and prioritization; ability to oversee live queues, recognize approaching SLA deadlines, direct timely follow-on actions, and maintain accurate incident and shift records. Strong analytical and troubleshooting skills to assess SIEM/EDR findings, correlate evidence, validate triage justifications, and pre-screen technical escalations for Google SecOps engineering. Ability to reinforce end-to-end partner incident ownership during consults, sustain customer updates, and ensure complete, immediately accepted High/Critical shift handoffs. Ability to coach analysts, identify recurring noisy alerts and broken playbooks, and partner with engineering teams on detection tuning, playbook development, and operational improvement. Ability to support 24/7/365 operations, including overnight, weekend, and holiday coverage, coordinate room presence, and adapt to changing mission needs and operational disruptions. How you’ll grow At Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there’s always room to learn. We offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers. Benefits At Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits. Learn more about what working at Chenega MIOS can mean for you. Chenega MIOS’s culture Our positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives. Corporate citizenship Chenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities. Learn more about Chenega’s impact on the world. Tips from your Talent Acquisition Team We want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links: Chenega MIOS web site - Glassdoor - LinkedIn - Facebook - #Astraeus Operations Estimated Salary/Wage USD $185,000.00/Yr. Up to USD $188,000.00/Yr. #J-18808-Ljbffr