layiq

/la·yiq/adjective

worthy; deserving; fitting; suitable.

A role, opportunity, or path that merits attention, time, and pursuit.

LAYIQ - Defensive Cyber Ops Lead at Nightwing Intelligence Solutions

Defensive Cyber Operations Leadership
Serve as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annually
Manage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operations
Serve as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignment
Lead threat detection, incident response, and threat hunting operations across enterprise-scale networks
Oversee cyber defense missions including intrusion detection, malware analysis, and network defense operations
Direct Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilities
Drive tactical and operational decisions during cyber incidents and defensive operations
Personnel & Readiness Management
Match personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operators
Maintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levels
Ensure team maintains readiness to support dynamic threat environments and surge requirements with minimal notice
Coordinate personnel scheduling and duty assignments across multiple operational shifts and mission sets
Conduct operational readiness assessments and capability gap analysis
Support technical hiring, training, and professional development to maintain mission-critical capabilities
Foster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordination
Mission Coordination & Stakeholder Engagement
Interface directly with military cyber operations teams, intelligence analysts, and mission partners on operational matters
Ensure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholders
Provide situational awareness and operational status updates to program leadership and customers
Support planning and execution of defensive cyber operations including coordinated hunts and incident response
Present operational updates and threat briefings to C-suite and senior government leadership
Build and maintain strong operational relationships that enhance mission effectiveness and information sharing
Coordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterprise
Operational Performance & Metrics Management
Track and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectiveness
Generate regular operational reports on threat activity, incident response performance, and defensive posture
Identify operational trends through threat intelligence analysis and implement proactive defensive measures
Support after-action reviews (AARs) and lessons learned processes to improve operational effectiveness
Maintain operational documentation including standard operating procedures (SOPs), playbooks, and run books
Provide executive-level reporting on operational readiness and threat landscape
Ensure Service Level Agreement (SLA) compliance for detection, response, and escalation timelines
Capability Development & Training
Assess and develop team capabilities to meet evolving threat landscape and mission requirements
Recommend training and professional development opportunities including certifications, technical training, and operational exercises
Support integration of new tools, techniques, and procedures (TTPs) into defensive operations
Lead operational training exercises and tabletop exercises to maintain team proficiency
Foster culture of continuous learning, threat intelligence sharing, and operational innovation
Develop and maintain threat-informed defensive strategies and operational concepts
Technical Operations & System Integration
Oversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber tools
Ensure integration and operational effectiveness of threat detection, hunting, and response technologies
Support tuning and optimization of detection content, correlation rules, and alert workflows
Coordinate with engineering teams on tool deployment, configuration, and operational support
Maintain situational awareness of network architecture, critical assets, and defensive coverage
Support continuous monitoring requirements for accredited systems and compliance with IA standards
Operational Risk Management & Mission Assurance
Identify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operations
Develop and implement tactical response procedures and escalation protocols for cyber incidents
Ensure operational continuity during high-threat periods, system outages, or personnel transitions
Navigate operational constraints while maintaining unwavering mission focus and defensive posture
Support crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacks
Balance operational tempo with sustainable operations and team well-being during extended operations
Required Qualifications
Education & Certification
Bachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM field
Security+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification
Experience
Defensive Cyber Operations Leadership (One of the following): 10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams
8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)
10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions
Domain Experience (One of the following): 5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus
5-8 years detection engineering and automation experience
5-8 years cyber operations or threat hunting with Intelligence Community customers
Technical Knowledge
Deep understanding of defensive cyber operations, threat detection methodologies, and incident response processes
Demonstrated experience with programs of similar size and scope supporting Intelligence Community missions
Extensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groups
Strong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environments
Experience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologies
Working knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK framework
Familiarity with network security monitoring, log analysis, and forensic investigation techniques
Understanding of Cyber Operations and partner cyber mission teams
Leadership & Stakeholder Management
Exceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditions
Demonstrated success in mission environments requiring rapid operational decision-making and tactical leadership
Track record of building and maintaining high-performing cyber defense teams with strong retention and morale
Strong operational presence with ability to brief senior military and civilian leadership during incidents
Experience managing in military or intelligence community operational environments with complex reporting structures
Proven ability to coordinate across organizational boundaries including military, intelligence, and contractor teams

Experience within Intelligence Community and Cyber mission partner environments
Advanced GIAC certifications: GCIH, GCIA, GCFA, GNFA, GREM, or equivalent advanced certifications
Multiple advanced certifications: CISSP, CISM, GCTI, CEH, or offensive security certifications
Experience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missions
Background in threat intelligence analysis, malware reverse engineering, or advanced threat hunting
Experience with cloud security operations (AWS, Azure, GCP) and hybrid network defense
Prior experience managing 24/7/365 SOC operations with multi-tiered support structures
Experience supporting classified programs at TS/SCI level with special access programs (SAP)
Track record of operational innovation improving detection, response, or threat hunting capabilities
Key Attributes
Mission-first operational leader with relentless focus on defensive effectiveness and team readiness
Tactical and strategic thinker who can balance immediate threats with long-term defensive posture
Calm under pressure with proven ability to lead during active incidents, breaches, or complex investigations
Effective communicator across tactical, operational, and strategic levels
Team builder with mentorship focus and commitment to developing next-generation cyber defenders
Decisive operational commander who thrives in high-pressure environments
Threat-focused leader who stays current on adversary TTPs and emerging threats
Collaborative partner able to coordinate across military, intelligence, and contractor organizations
Technically credible with hands-on experience that earns respect from operational teams
Ethical leader committed to responsible cyber operations and mission integrity
Success Metrics
Threat detection effectiveness with measurable improvement in detection rates and reduction in dwell time
Incident response performance meeting or exceeding MTTD and MTTR targets
Operational readiness with teams maintaining required certifications, training, and capability levels
Customer satisfaction with defensive cyber operations and incident response (CPARS ratings of Very Good or Exceptional)
Team performance including retention, morale, proficiency assessments, and operational tempo sustainability
Mission impact through successful threat detection, incident containment, and adversary disruption
Innovation adoption with measurable improvement in defensive capabilities through new tools and techniques
SLA compliance consistently achieving contractual performance targets for detection and response
Why Nightwing
Lead mission-critical maintenance operations directly supporting Intelligence Community operations and national security objectives
Exercise full operational authority with meaningful impact on system availability, mission effectiveness, and operational readiness
Build and lead high-performing maintenance teams of talented professionals supporting cutting-edge cyber and intelligence systems
Partner directly with senior government customers in the Intelligence Community on programs of strategic importance
Operate in environments where your operational leadership and decisions truly matter to mission success
Competitive compensation with performance-based incentives tied to operational performance and SLA achievement
Opportunity to work on challenging operational problems supporting critical national security missions
At Nightwing, we value collaboration and teamwork. You'll have the opportunity to work alongside talented individuals who are passionate about what they do. Together, we'll leverage our collective expertise to drive innovation, solve complex problems, and deliver exceptional results for our clients.
Thank you for considering joining us as we embark on this new journey and shape the future of cybersecurity and intelligence together as part of the Nightwing team.

Defensive Cyber Ops Lead

Employer job description

Key Responsibilities

Preferred Qualifications

Salary & Benefits

About this listing

Listing check

Before you apply

Similar jobs

Similar jobs