Defensive Cyber Ops Lead

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.

We are seeking an exceptional Defensive Cyber Operations Lead to manage daily cyber defense tasking and operational tempo, serving as the primary liaison between contractor personnel and mission counterparts to ensure seamless coordination and mission alignment. This role requires a proven senior-level technical authority who can match personnel skills and certifications to operational requirements and mission priorities while managing complex, large-scale operations supporting critical national security missions.

Nightwing delivers end-to-end secure IT services leveraging deep experience in Offensive Cyber Operations (OCO), Defensive Cyber Operations (DCO), Cyber Vulnerability Assessments (CVAs), and systems integration. As Defensive Cyber Operations Lead, you will translate operational requirements into actionable defensive cyber missions, lead threat detection and response operations, and ensure our cyber defense capabilities remain operationally effective in dynamic threat environments.

You will be responsible for maintaining operational readiness of cyber defense teams operating within accredited environments, ensuring compliance with DoD Information Assurance (IA) requirements, and supporting defensive cyber operations across systems with Authority to Operate (ATO). This includes leading threat hunting activities, incident response operations, and continuous monitoring that meet operational security standards and mission requirements.

This is a high-visibility, operationally critical leadership position requiring an individual who can lead cyber defense teams supporting programs with 50+ FTEs, navigate 24/7/365 operational environments in mission settings, and drive organizational success through operational excellence, mission-focused leadership, and tactical proficiency. You will be accountable for the operational readiness and defensive posture of teams supporting critical Intelligence Community operations.

Key Responsibilities

- Defensive Cyber Operations Leadership
- Serve as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annually
- Manage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operations
- Serve as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignment
- Lead threat detection, incident response, and threat hunting operations across enterprise-scale networks
- Oversee cyber defense missions including intrusion detection, malware analysis, and network defense operations
- Direct Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilities
- Drive tactical and operational decisions during cyber incidents and defensive operations

Personnel & Readiness Management

- Match personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operators
- Maintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levels
- Ensure team maintains readiness to support dynamic threat environments and surge requirements with minimal notice
- Coordinate personnel scheduling and duty assignments across multiple operational shifts and mission sets
- Conduct operational readiness assessments and capability gap analysis
- Support technical hiring, training, and professional development to maintain mission-critical capabilities
- Foster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordination

Mission Coordination & Stakeholder Engagement

- Interface directly with military cyber operations teams, intelligence analysts, and mission partners on operational matters
- Ensure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholders
- Provide situational awareness and operational status updates to program leadership and customers
- Support planning and execution of defensive cyber operations including coordinated hunts and incident response
- Present operational updates and threat briefings to C-suite and senior government leadership
- Build and maintain strong operational relationships that enhance mission effectiveness and information sharing
- Coordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterprise

Operational Performance & Metrics Management

- Track and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectiveness
- Generate regular operational reports on threat activity, incident response performance, and defensive posture
- Identify operational trends through threat intelligence analysis and implement proactive defensive measures
- Support after-action reviews (AARs) and lessons learned processes to improve operational effectiveness
- Maintain operational documentation including standard operating procedures (SOPs), playbooks, and run books
- Provide executive-level reporting on operational readiness and threat landscape
- Ensure Service Level Agreement (SLA) compliance for detection, response, and escalation timelines

Capability Development & Training

- Assess and develop team capabilities to meet evolving threat landscape and mission requirements
- Recommend training and professional development opportunities including certifications, technical training, and operational exercises
- Support integration of new tools, techniques, and procedures (TTPs) into defensive operations
- Lead operational training exercises and tabletop exercises to maintain team proficiency
- Foster culture of continuous learning, threat intelligence sharing, and operational innovation
- Develop and maintain threat-informed defensive strategies and operational concepts

Technical Operations & System Integration

- Oversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber tools
- Ensure integration and operational effectiveness of threat detection, hunting, and response technologies
- Support tuning and optimization of detection content, correlation rules, and alert workflows
- Coordinate with engineering teams on tool deployment, configuration, and operational support
- Maintain situational awareness of network architecture, critical assets, and defensive coverage
- Support continuous monitoring requirements for accredited systems and compliance with IA standards

Operational Risk Management & Mission Assurance

- Identify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operations
- Develop and implement tactical response procedures and escalation protocols for cyber incidents
- Ensure operational continuity during high-threat periods, system outages, or personnel transitions
- Navigate operational constraints while maintaining unwavering mission focus and defensive posture
- Support crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacks
- Balance operational tempo with sustainable operations and team well-being during extended operations

Required Qualifications

Education & Certification

- Bachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM field
- Security+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification

Experience

- Defensive Cyber Operations Leadership (One of the following):
- 10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams
- 8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)
- 10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions

Domain Experience (One of the following):

- 5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus
- 5-8 years detection engineering and automation experience
- 5-8 years cyber operations or threat hunting with Intelligence Community customers

Technical Knowledge

- Deep understanding of defensive cyber operations, threat detection methodologies, and incident response processes
- Demonstrated experience with programs of similar size and scope supporting Intelligence Community missions
- Extensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groups
- Strong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environments
- Experience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologies
- Working knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK framework
- Familiarity with network security monitoring, log analysis, and forensic investigation techniques
- Understanding of Cyber Operations and partner cyber mission teams

Leadership & Stakeholder Management

- Exceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditions
- Demonstrated success in mission environments requiring rapid operational decision-making and tactical leadership
- Track record of building and maintaining high-performing cyber defense teams with strong retention and morale
- Strong operational presence with ability to brief senior military and civilian leadership during incidents
- Experience managing in military or intelligence community operational environments with complex reporting structures
- Proven ability to coordinate across organizational boundaries including military, intelligence, and contractor teams

Preferred Qualifications

- Experience within Intelligence Community and Cyber mission partner environments
- Advanced GIAC certifications: GCIH, GCIA, GCFA, GNFA, GREM, or equivalent advanced certifications
- Multiple advanced certifications: CISSP, CISM, GCTI, CEH, or offensive security certifications
- Experience leading Cyber Mission Force teams, Hunt Forward operations, or similar operational missions
- Background in threat intelligence analysis, malware reverse engineering, or advanced threat hunting
- Experience with cloud security operations (AWS, Azure, GCP) and hybrid network defense
- Prior experience managing 24/7/365 SOC operations with multi-tiered support structures
- Experience supporting classified programs at TS/SCI level with special access programs (SAP)
- Track record of operational innovation improving detection, response, or threat hunting capabilities

Key Attributes

- Mission-first operational leader with relentless focus on defensive effectiveness and team readiness
- Tactical and strategic thinker who can balance immediate threats with long-term defensive posture
- Calm under pressure with proven ability to lead during active incidents, breaches, or complex investigations
- Effective communicator across tactical, operational, and strategic levels
- Team builder with mentorship focus and commitment to developing next-generation cyber defenders
- Decisive operational commander who thrives in high-pressure environments
- Threat-focused leader who stays current on adversary TTPs and emerging threats
- Collaborative partner able to coordinate across military, intelligence, and contractor organizations
- Technically credible with hands-on experience that earns respect from operational teams
- Ethical leader committed to responsible cyber operations and mission integrity

Success Metrics

- Threat detection effectiveness with measurable improvement in detection rates and reduction in dwell time
- Incident response performance meeting or exceeding MTTD and MTTR targets
- Operational readiness with teams maintaining required certifications, training, and capability levels
- Customer satisfaction with defensive cyber operations and incident response (CPARS ratings of Very Good or Exceptional)
- Team performance including retention, morale, proficiency assessments, and operational tempo sustainability
- Mission impact through successful threat detection, incident containment, and adversary disruption
- Innovation adoption with measurable improvement in defensive capabilities through new tools and techniques
- SLA compliance consistently achieving contractual performance targets for detection and response

Why Nightwing

- Lead mission-critical maintenance operations directly supporting Intelligence Community operations and national security objectives
- Exercise full operational authority with meaningful impact on system availability, mission effectiveness, and operational readiness
- Build and lead high-performing maintenance teams of talented professionals supporting cutting-edge cyber and intelligence systems
- Partner directly with senior government customers in the Intelligence Community on programs of strategic importance
- Operate in environments where your operational leadership and decisions truly matter to mission success
- Competitive compensation with performance-based incentives tied to operational performance and SLA achievement
- Opportunity to work on challenging operational problems supporting critical national security missions

At Nightwing, we value collaboration and teamwork. You'll have the opportunity to work alongside talented individuals who are passionate about what they do. Together, we'll leverage our collective expertise to drive innovation, solve complex problems, and deliver exceptional results for our clients.

Thank you for considering joining us as we embark on this new journey and shape the future of cybersecurity and intelligence together as part of the Nightwing team.

Salary & Benefits
The salary associated with this position ($147,000-$296,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise. Compensation will be determined based on these factors to ensure alignment with skills, responsibilities, and market standards.
Nightwing offers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.

Nightwing is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.