Cyber Threat Operations Program Manager

Job Description

Job Description:\n\nBy joining the National Student Clearinghouse, you can be sure that the work you do now will help shape the future of education and the workforce in the U.S. As the trusted source for higher education data since 1993, the Clearinghouse is the leading provider of transcript and data exchange services, automated enrollment and degree verifications, learner insights and research, and compliance solutions for schools, businesses, and learners nationwide. As a 501(c)(3) nonprofit organization, the Clearinghouse works with nearly 3,600 postsecondary institutions to meet their compliance needs and with thousands of high schools and districts to provide continuing collegiate enrollment, progression, and completion statistics about their alumni. In addition, the Research Center publications inform policymakers and business leaders about student educational pathways. Using our unique combination of data, analytics, and software to drive our mission, security and privacy is paramount. Join us as we continue to invest in our talent and new advanced technologies to unlock the power of data on behalf of all learners. About the Role:\nThe Technical Specialist, Threat Operations serves as a senior operational leader and key partner within the Cyber Operations team, acting as the functional second-in-command across threat operations activities. This role is responsible for building, scaling, and sustaining a comprehensive threat operations program that translates threat and exposure signals into actionable insights and business risk decisions.\nThis position combines hands-on operational oversight—including detection, triage, investigation, and response—with ownership of strategic program elements such as threat intelligence, lifecycle governance, and Continuous Threat Exposure Management (CTEM). The role also requires leadership through influence, driving consistent execution, talent development, and high-quality outcomes across analysts, partners, and stakeholders.\nThe Technical Specialist, Threat Operations is expected to maximize AI-assisted and agentic AI workflows while maintaining human accountability, secure data handling, and audit-ready evidence. All outputs must remain defensible, traceable, and aligned with enterprise governance standards.\nCurrently, this is a remote-first position, and this position may be required to periodically work on-site at our office and the frequency would depend on the department/division's requirements. Therefore, candidates must either reside within a reasonable distance to commute to our office or be willing to travel to our office in Herndon, when required.How You Contribute:\n\n Demonstrate the Clearinghouse's core competencies: Customer Focus, Optimizes Work Processes, Collaborates, Communicates Effectively, and Be Open and Authentic.\n Oversee detection, triage, and validation of security alerts, ensuring timely and evidence-based disposition.\n Translate technical findings into clear risk-based recommendations and actionable next steps.\n Serve as escalation lead during high-severity incidents, ensuring proper scoping, documentation, and remediation to closure.\n Develop and mature the threat operations program roadmap, including CTEM strategy and operating model.\n Perform business-centric threat modeling to align adversary activity with enterprise risk and impact.\n Define governance frameworks, including prioritization logic, escalation criteria, and executive reporting.\n Design and continuously improve repeatable workflows, including AI-assisted triage, investigation, and reporting processes.\n Establish and manage key performance indicators (e.g., MTTD, MTTR, detection quality, noise reduction).\n Maintain playbooks, investigation templates, and escalation workflows to ensure consistency and audit readiness.\n Drive continuous improvement of detection fidelity through tuning and feedback loops.\n Implement AI-assisted workflows with clear human-in-the-loop validation and decision points.\n Ensure secure handling of sensitive data and alignment with enterprise AI governance policies.\n Validate AI outputs for accuracy and reliability and mitigate known risks such as hallucinations, bias, or incomplete context.\n Harden AI processes against adversarial threats (e.g., prompt injection, data leakage).\n Lead the threat intelligence lifecycle, including requirements, collection, analysis, dissemination, and feedback.\n Translate intelligence into actionable outputs such as threat hunts, detection priorities, and control validation.\n Deliver executive-ready threat assessments with clear sourcing and confidence levels.\n Establish operating rhythms and performance expectations with external security partners.\n Ensure alignment with MITRE ATT&CK coverage and measurable detection and response outcomes.\n Integrate partner outputs into internal workflows, ensuring accountability and closure of findings.\n Lead investigations involving cloud control plane threats (such as AWS and OCI), focusing on identity and configuration risks.\n Correlate cloud, endpoint, identity, and network signals to prioritize remediation based on risk.\n Partner with engineering teams to validate remediation and risk acceptance actions and decisions.\n Coordinate with incident response, engineering, and business stakeholders to drive remediation.\n Integrate third-party risk insights into threat analysis and recommendations.\n Partner with architecture and assurance teams to improve long-term security controls.\n\nPosition may be required to perform other duties as required. These essential functions are representative of those that must be met by an employee to successfully perform the job. Reasonable accommodations will be made to enable individuals with disabilities to perform these essential functions.What You Bring to the Table:\n\n Bachelors degree in Cybersecurity, Computer Science, IT, or any related field. A combination of education and experience including military service will also be considered.\n A current, active certification in CISSP, CISM, GIAC, CySA+, Microsoft Security, or another recognized cloud security discipline is required. Candidates who do not currently hold one of these certifications must be willing and able to obtain and maintain at least one qualifying certification within one year of their employment start date.\n 10 years of direct experience in cybersecurity operations, incident response, or threat analysis.\n Experience investigating cloud security issues (AWS and/or OCI).\n Hands-on experience with AI-assisted security workflows and governance-aligned practices.\n Experience developing threat intelligence or CTEM-aligned programs.\n Experience managing external security partners and service delivery (e.g., MDR/MSSP), including performance outcomes, SLAs, and continuous improvement.\n Strong knowledge of threat operations, incident response, and investigation methodologies.\n Advanced understanding of MITRE ATT&CK framework and detection coverage strategies.\n Knowledge of cloud security threats (AWS, OCI), particularly identity and control plane risks.\n Understanding of threat intelligence lifecycle and CTEM program implementation.\n Knowledge of enterprise AI governance, including generative AI risks and controls.\n Ability to build and scale threat operations processes and programs.\n Ability to develop metrics and reporting frameworks that drive decision-making.\n Experience designing AI-assisted investigation and triage workflows.\n Ability to translate technical risk into business-aligned remediation strategies.\n Strong decision-making skills under uncertainty, supported by defensible evidence.\n Excellent communication skills with both technical and executive audiences.\n High degree of judgment, integrity, and accountability.\n Ability to collaborate cross-functionally and influence without direct authority.\n Demonstrated leadership through influence across matrixed teams, partners, and stakeholders, including prioritization, coaching, performance feedback, and operational execution.\n Exceptional ability to translate and communicate technical risk, threat assessments, and mitigation strategies to technical, executive, and board-level audiences.\n Demonstrates the Clearinghouse’s core competencies: customer focus, optimizes work processes, communicates effectively, collaborates, and is open and authentic.\n Must live within a commutable distance to Herndon, VA or in one of the Clearinghouse's approved States for hiring purposes. Refer to our HR Policies Page, located on our Careers site at for more details.\n Must be currently authorized to work in the United States on a full-time basis. We do not intend to sponsor external applicants for work visas, and may consider sponsorship only if no qualified candidates can be found who are authorized to work without sponsorship.\n Must be at least 18 years old.\n\nAdditional Desired Qualifications\n\n Experience building or maturing CTEM programs.\n Experience managing MDR/MSSP vendors using outcomes-based metrics.\n Scripting or query language experience (e.g., Python, PowerShell, KQL).\n Experience presenting to senior leadership or board-level audiences.\n Experience with SOAR automation and AI-assisted investigation workflows.\n Experience with enterprise Copilot tools and governed AI environments.\n Knowledge of security tools such as Microsoft Defender, Wiz Defend, etc.\n Experience implementing QA and validation processes for AI outputs.\n Prior experience managing direct reports within a cybersecurity, threat intel, or technical. environment\nPhysical Demands:\n\n Use of a computer for 8 or more hours a day.\n Use of a telephone and/or copy machine.\n Frequently required to sit for 7 or more hours per day.\n Occasionally required to use hands and fingers to operate, handle, and reach.\n Vision abilities include close vision and the ability to adjust focus.\nBenefits and Related Information\nThe National Student Clearinghouse provides a robust benefit program designed to help meet the needs of each employee and their family, both now and in the future. We offer comprehensive medical, dental, and vision insurance, as well as life and disability insurance benefits, for employees and their qualified dependents. Health care, dependent care, and limited purpose flexible spending accounts, as well as a health savings account with annual employer contributions of $300 for employees and $600 for employees who are enrolled with their spouse and/or dependents, voluntary supplemental health plans for Accident and Hospital Indemnity coverage, and infertility coverage are options available for employees to set aside pre-taxed dollars for certain qualifying expenses. We offer a very generous 401k matching contribution program with the opportunity to defer pre-tax and Roth contributions, as well as catch-up contributions for those who are eligible! We are proud to offer a competitive paid leave program consisting of vacation, sick, and personal time, as well as paid holidays, up to 3 weeks of paid parental leave during a 12-month period , and up to 5 days of paid military leave per calendar year . Vacation time will accrue based on length of service, and new full-time hires can accrue up to 13 days of vacation and up to 10 days of sick time per year. On an annual basis, new employees may use up to 32 hours of accrued sick time as personal time. Additionally, the Clearinghouse observes at least 15 paid holidays per year, including company year-end close between Christmas and New Years Holidays.\n Another perk is that employees have the option to get reimbursed for basic wholesale company and roadside assistance memberships (e.g., Costco and AAA) and to request a buy back on portions of unused accrued vacation based on tenure and certain other qualifications. Employees can further their education and professional development by using our Employee Education Assistance Program, which establishes reimbursement for qualified education expenses upon successful completion of the program, and leveraging the enterprise-wide LinkedIn Learning subscription. There are additional employee benefits too, including but not limited to, mental health with up to eight free therapy sessions for employees and their family members and well-being reward benefits. With the Clearinghouse being an eligible 501(3)(c) nonprofit organization, employees are eligible for service credit towards the Public Service Loan Forgiveness program (PSLF). To find out more, please request a copy of our Benefits at a Glance! \nAdditionally, we reasonably believe that the salary range for this position is between $175,000 and $212,000.\nThe pay range listed above represents a good faith estimate and is not a guarantee of compensation or salary. The National Student Clearinghouse considers multiple factors when determining base pay for offers, including but not limited to the responsibilities and scope of the role, as well as a candidate’s experience, education, knowledge, skills, abilities, internal equity, and alignment with market data.\nInternal Candidates: If you feel you meet the qualifications for the role, we strongly encourage you to apply and focus on preparing for the application process. Finalist internal candidates will receive a compensation review prior to any offer being made. In accordance with the Clearinghouse’s compensation and promotion guidelines, internal compensation practices will be applied first, which may result in pay that differs from the posted salary range.This job announcement was posted to the National Student Clearinghouse’s Careers site at on 9/14//2026 and the online application period will be open for at least 3 days from this posting date. A completed online application is required to be considered for this opportunity.\n\nEqual Opportunity Employer/Protected Veterans/Individuals with Disabilities: The National Student Clearinghouse is proud to be an Equal Opportunity Employer. Qualified applicants will receive consideration for employment without regard to actual or perceived race, creed, color, religion, alienage or national origin, ancestry, citizenship status, age, disability or handicap, sex, marital status, veteran status (or known to have a spousal, family, business, social or other relationship or association with a protected veteran), sexual orientation, genetic information, arrest record, natural hairstyle, or any other characteristic protected by applicable federal, state, or local laws. Our management team is dedicated to this policy with respect to recruitment, hiring, placement, promotion, transfer, training, compensation, benefits, employee activities and general treatment during employment.\nPay Transparency Notice: The National Student Clearinghouse is a federal contractor that abides by all applicable equal opportunity laws and regulations. Under these laws, companies doing busine