Security Operations

• Serve as the enterprise technical authority for security orchestration across Splunk SOAR and Tines
• Define and evolve the long‑term architecture, strategy, and roadmap for SOAR and automation platforms
• Establish enterprise standards, reusable frameworks, and orchestration patterns to drive consistency and scale
• Lead end‑to‑end design authority for complex, cross‑platform automation initiatives
• Partner with Product Management and senior leadership to shape portfolio prioritization and strategic investments
• Drive intake governance model, ensuring automation demand is evaluated, prioritized, and aligned to measurable outcomes
• Define and track enterprise value metrics (MTTR reduction, analyst efficiency, operational risk reduction, automation coverage)
• Influence and guide multiple security domain teams (15+ teams) to adopt standardized automation patterns and best practices
• Provide technical leadership and mentorship to senior and principal engineers across SOAR platforms
• Act as escalation point for high‑risk, high‑complexity orchestration challenges and systemic platform issues
• Lead design and oversight of enterprise integrations, including but not limited to: Microsoft Graph / Entra ID / M365 Defender, CrowdStrike Falcon, Tanium, BloodHound, Anvilogic, ThreatQ, ServiceNow (Incidents, SecOps, CMDB, IR workflows)
• Drive platform reliability, resilience, and auditability standards across all automation implementations
• Define enterprise vision for AI‑driven security operations, including copilots, agents, and MCP‑aligned orchestration
• Lead design of AI‑assisted investigation, triage, and response workflows integrated with SOAR decisioning
• Establish and enforce enterprise AI governance framework, including: Human‑in‑the‑loop approval models and escalation paths, Deterministic fallback and fail‑safe execution patterns, Access controls, observability, logging, and auditability aligned with enterprise risk standards
• Define architectural patterns for AI‑integrated SOAR systems, including: Retrieval‑Augmented Generation (RAG) design and secure knowledge integration, Vector embedding strategies for semantic search and correlation, Scalable data pipelines for incident context, detections, and response history
• Evaluate and approve AI use cases based on operational value, risk, and production readiness
• Partner with governance, risk, and compliance teams to ensure safe, auditable deployment of AI capabilities.

Security Incident Response Lead

• Provide day-to-day technical oversight, coordination, and guidance to contractor personnel performing operational cybersecurity and threat intelligence functions.
• Lead all activities supporting the National Cybersecurity Operations (NCO) mission including threat intelligence collection and analysis, threat hunting, and incident response coordination.
• Monitor and analyze cyber threat intelligence relevant to FAA and NAS systems.
• Produce actionable intelligence products that inform assessment priorities and defensive posture decisions.
• Coordinate incident response activities when potential security events are identified.
• Ensure response actions follow established procedures and are documented.
• Attend all Program Management Reviews with the Program Manager and report on NCO operational support activities, threat intelligence findings, deliverables, and technical issues.
• Maintain awareness of emerging cyber threats targeting critical infrastructure, aviation systems, and government networks.
• Brief FAA leadership on threat trends and recommended defensive actions.
• Collaborate with the Security Assessment Lead and Penetration Testing Lead to ensure assessment and testing priorities reflect the current threat landscape.
• Develop and maintain standard operating procedures for NCO functions including escalation criteria, reporting templates, and coordination protocols.
• Manage and oversee contractor staff performing NCO functions.
• Ensure personnel maintain required qualifications and training.

NCO Technical Lead

• Monitor security alerts and events in the Security Operations Center (SOC) and perform initial triage, analysis, and escalation as needed.
• Investigate potential security incidents using SIEM, endpoint, network, and other security tools to determine scope, impact, and next steps.
• Document findings, actions taken, and incident details clearly and accurately in accordance with SOC procedures and reporting requirements.
• Escalate confirmed or high-risk incidents to senior analysts or incident response teams when appropriate.
• Support threat detection, alert tuning, and ongoing improvement of SOC monitoring processes and playbooks.
• Collaborate with internal teams to gather information, support investigations, and help protect enterprise systems and data.
• Stay current on common cyber threats, vulnerabilities, and attacker tactics, techniques, and procedures (TTPs).

SOC Analyst, Tier 1

• Align security processes, policies, and procedures with established security standards and operational goals
• Collaborate with the Patch Management Team to support enterprise security and compliance initiatives
• Assess malware activity and evaluate potential impacts to systems, infrastructure, and operations
• Review vulnerability scan results to identify security risks and prioritize remediation efforts
• Analyze infrastructure configurations and security controls to ensure compliance with organizational policies and practices
• Manage the distribution and deployment of Microsoft operating system patches across the enterprise environment
• Deploy third-party software patches using Enterprise Lifecycle Management Services (ELMS) and Microsoft Endpoint Configuration Manager (MECM)
• Monitor patching activities to verify successful installation, compliance, and system stability
• Investigate security findings and recommend corrective actions to reduce vulnerabilities and strengthen system security
• Support continuous improvement of security operations by identifying opportunities to enhance patch management, vulnerability management, and compliance processes

IT Security Operations Analyst

• Analyze intricate cybersecurity challenges
• Cultivate substantial relationships with clients
• Broaden technical knowledge and proficiency in cybersecurity
• Develop and optimize detection rules, use cases, and playbooks within XSIAM OR Google SecOps
• Assist with onboarding new data sources and security tools integration for enriched threat visibility

Security Operations jobs in District of Columbia

See all jobs on JobTailor

Security Incident Response Lead

NCO Technical Lead

SOC Analyst, Tier 1

IT Security Operations Analyst

SecOps Engineer