{"id":2578795,"url":"https://alion.io/job/nightwing-defensive-cyber-ops-lead","title":"Defensive Cyber Ops Lead","company":{"id":3852631,"name":"Nightwing","domain":"nightwing.com","url":"https://alion.io/company/nightwing-2","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":96,"open_postings":247,"ghost_share":0,"stale_share":0.158,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Operations","role_family":"Operations","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sterling, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":87000,"max_usd":202000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1314},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-10-14T00:00:00Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-11-03T20:55:27Z","board_verified":true,"closed_at":null,"days_open":21,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":21},"description":"Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.\nWe are seeking an exceptional Defensive Cyber Operations Lead to manage daily cyber defense tasking and operational tempo, serving as the primary liaison between contractor personnel and mission counterparts to ensure seamless coordination and mission alignment. This role requires a proven senior-level technical authority who can match personnel skills and certifications to operational requirements and mission priorities while managing complex, large-scale operations supporting critical national security missions.\nNightwing delivers end-to-end secure IT services leveraging deep experience in Offensive Cyber Operations (OCO), Defensive Cyber Operations (DCO), Cyber Vulnerability Assessments (CVAs), and systems integration. As Defensive Cyber Operations Lead, you will translate operational requirements into actionable defensive cyber missions, lead threat detection and response operations, and ensure our cyber defense capabilities remain operationally effective in dynamic threat environments.\nYou will be responsible for maintaining operational readiness of cyber defense teams operating within accredited environments, ensuring compliance with DoD Information Assurance (IA) requirements, and supporting defensive cyber operations across systems with Authority to Operate (ATO). This includes leading threat hunting activities, incident response operations, and continuous monitoring that meet operational security standards and mission requirements.\nThis is a high-visibility, operationally critical leadership position requiring an individual who can lead cyber defense teams supporting programs with 50+ FTEs, navigate 24/7/365 operational environments in mission settings, and drive organizational success through operational excellence, mission-focused leadership, and tactical proficiency. You will be accountable for the operational readiness and defensive posture of teams supporting critical Intelligence Community operations.\nKey Responsibilities\nDefensive Cyber Operations Leadership\nServe as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annually\nManage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operations\nServe as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignment\nLead threat detection, incident response, and threat hunting operations across enterprise-scale networks\nOversee cyber defense missions including intrusion detection, malware analysis, and network defense operations\nDirect Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilities\nDrive tactical and operational decisions during cyber incidents and defensive operations\nPersonnel & Readiness Management\nMatch personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operators\nMaintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levels\nEnsure team maintains readiness to support dynamic threat environments and surge requirements with minimal notice\nCoordinate personnel scheduling and duty assignments across multiple operational shifts and mission sets\nConduct operational readiness assessments and capability gap analysis\nSupport technical hiring, training, and professional development to maintain mission-critical capabilities\nFoster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordination\nMission Coordination & Stakeholder Engagement\nInterface directly with military cyber operations teams, intelligence analysts, and mission partners on operational matters\nEnsure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholders\nProvide situational awareness and operational status updates to program leadership and customers\nSupport planning and execution of defensive cyber operations including coordinated hunts and incident response\nPresent operational updates and threat briefings to C-suite and senior government leadership\nBuild and maintain strong operational relationships that enhance mission effectiveness and information sharing\nCoordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterprise\nOperational Performance & Metrics Management\nTrack and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectiveness\nGenerate regular operational reports on threat activity, incident response performance, and defensive posture\nIdentify operational trends through threat intelligence analysis and implement proactive defensive measures\nSupport after-action reviews (AARs) and lessons learned processes to improve operational effectiveness\nMaintain operational documentation including standard operating procedures (SOPs), playbooks, and run books\nProvide executive-level reporting on operational readiness and threat landscape\nEnsure Service Level Agreement (SLA) compliance for detection, response, and escalation timelines\nCapability Development & Training\nAssess and develop team capabilities to meet evolving threat landscape and mission requirements\nRecommend training and professional development opportunities including certifications, technical training, and operational exercises\nSupport integration of new tools, techniques, and procedures (TTPs) into defensive operations\nLead operational training exercises and tabletop exercises to maintain team proficiency\nFoster culture of continuous learning, threat intelligence sharing, and operational innovation\nDevelop and maintain threat-informed defensive strategies and operational concepts\nTechnical Operations & System Integration\nOversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber tools\nEnsure integration and operational effectiveness of threat detection, hunting, and response technologies\nSupport tuning and optimization of detection content, correlation rules, and alert workflows\nCoordinate with engineering teams on tool deployment, configuration, and operational support\nMaintain situational awareness of network architecture, critical assets, and defensive coverage\nSupport continuous monitoring requirements for accredited systems and compliance with IA standards\nOperational Risk Management & Mission Assurance\nIdentify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operations\nDevelop and implement tactical response procedures and escalation protocols for cyber incidents\nEnsure operational continuity during high-threat periods, system outages, or personnel transitions\nNavigate operational constraints while maintaining unwavering mission focus and defensive posture\nSupport crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacks\nBalance operational tempo with sustainable operations and team well-being during extended operations\nRequired Qualifications\nEducation & Certification\nBachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM field\nSecurity+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification\nExperience\nDefensive Cyber Operations Leadership (One of the following):\n10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams\n8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)\n10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions\nDomain Experience (One of the following):\n5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus\n5-8 years detection engineering and automation experience\n5-8 years cyber operations or threat hunting with Intelligence Community customers\nTechnical Knowledge\nDeep understanding of defensive cyber operations, threat detection methodologies, and incident response processes\nDemonstrated experience with programs of similar size and scope supporting Intelligence Community missions\nExtensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groups\nStrong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environments\nExperience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologies\nWorking knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK framework\nFamiliarity with network security monitoring, log analysis, and forensic investigation techniques\nUnderstanding of Cyber Operations and partner cyber mission teams\nLeadership & Stakeholder Management\nExceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditions\nDemonstrated success in mission environments requiring rapid operational decision-making and tactical leadership\nTrack record of building and maintaining high-performing cyber defense teams with strong retention and morale\nStrong operational presence with ability to brief senior military and civilian leadership during incidents\nExperience managing in military or intelligence community operational environments with complex reporting structures\nProven ability to coordinate across organizational boundaries including military, intelligence, and contractor teams\nPreferred Qualifications\nExperience within Intelligence Community and Cyber mission partner environments\nAdvanced GIAC certifications: GCIH, GCIA, GCFA, GNFA, GREM, or equivalent advanced certifications\nMultiple advanced certifications: CISSP, CISM, GCTI, CEH, or offensive security certifications\nExperience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missions\nBackground in threat intelligence analysis, malware reverse engineering, or advanced threat hunting\nExperience with cloud security operations (AWS, Azure, GCP) and hybrid network defense\nPrior experience managing 24/7/365 SOC operations with multi-tiered support structures\nExperience supporting classified programs at TS/SCI level with special access programs (SAP)\nTrack record of operational innovation improving detection, response, or threat hunting capabilities\nKey Attributes\nMission-first operational leader with relentless focus on defensive effectiveness and team readiness\nTactical and strategic thinker who can balance immediate threats with long-term defensive posture\nCalm under pressure with proven ability to lead during active incidents, breaches, or complex investigations\nEffective communicator across tactical, operational, and strategic levels\nTeam builder with mentorship focus and commitment to developing next-generation cyber defenders\nDecisive operational commander who thrives in high-pressure environments\nThreat-focused leader who stays current on adversary TTPs and emerging threats\nCollaborative partner able to coordinate across military, intelligence, and contractor organizations\nTechnically credible with hands-on experience that earns respect from o...","description_format":"text","description_chars":15005,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["401k plan","Continuous learning","Dental insurance","Insurance coverage","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["National Security","Incident Response","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-15T01:03:53Z"}],"visa":[],"liveness":{"score":89,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.989,"p_room":0.9,"age_days":21,"expected_fill_days":50,"reasons":["conf:9","urgency","velocity","win:mid","comp:brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/nightwing-defensive-cyber-ops-lead","json_url":"https://alion.io/job/nightwing-defensive-cyber-ops-lead.json","meta":{"generated_at":"2026-11-04T08:01:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12525,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3852631},"rest":"https://alion.io/mcp/rest/get_company?id=3852631"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnightwing-defensive-cyber-ops-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnightwing-defensive-cyber-ops-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnightwing-defensive-cyber-ops-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nightwing-defensive-cyber-ops-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnightwing-defensive-cyber-ops-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2578795}},{"tool":"search_jobs","arguments":{"company":"nightwing.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2578795},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}