Defensive Cyber Ops Lead with Security Clearance

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers' most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.

We are seeking an exceptional Defensive Cyber Operations Lead to manage daily cyber defense tasking and operational tempo, serving as the primary liaison between contractor personnel and mission counterparts to ensure seamless coordination and mission alignment. This role requires a proven senior-level technical authority who can match personnel skills and certifications to operational requirements and mission priorities while managing complex, large-scale operations supporting critical national security missions.

Nightwing delivers end-to-end secure IT services leveraging deep experience in Offensive Cyber Operations (OCO), Defensive Cyber Operations (DCO), Cyber Vulnerability Assessments (CVAs), and systems integration. As Defensive Cyber Operations Lead, you will translate operational requirements into actionable defensive cyber missions, lead threat detection and response operations, and ensure our cyber defense capabilities remain operationally effective in dynamic threat environments.

You will be responsible for maintaining operational readiness of cyber defense teams operating within accredited environments, ensuring compliance with DoD Information Assurance (IA) requirements, and supporting defensive cyber operations across systems with Authority to Operate (ATO). This includes leading threat hunting activities, incident response operations, and continuous monitoring that meet operational security standards and mission requirements.

This is a high-visibility, operationally critical leadership position requiring an individual who can lead cyber defense teams supporting programs with 50+ FTEs, navigate 24/7/365 operational environments in mission settings, and drive organizational success through operational excellence, mission-focused leadership, and tactical proficiency. You will be accountable for the operational readiness and defensive posture of teams supporting critical Intelligence Community operations.

Key Responsibilities

• Defensive Cyber Operations Leadership
• Serve as the senior operational authority for all defensive cyber operations activities across the program portfolio valued at $50M+ annually
• Manage daily cyber defense tasking and operational battle rhythm supporting 24/7/365 Intelligence Community operations
• Serve as primary liaison between contractor personnel and military counterparts ensuring seamless coordination and mission alignment
• Lead threat detection, incident response, and threat hunting operations across enterprise-scale networks
• Oversee cyber defense missions including intrusion detection, malware analysis, and network defense operations
• Direct Security Operations Center (SOC) activities ensuring continuous monitoring and rapid response capabilities
• Drive tactical and operational decisions during cyber incidents and defensive operations

Personnel & Readiness Management

• Match personnel skills and certifications to operational requirements and mission priorities across 50+ cyber operators
• Maintain comprehensive skills matrix of cyber tasking staff tracking certifications, specializations, and operational readiness levels
• Ensure team maintains readiness to support dynamic threat environments and surge requirements with minimal notice
• Coordinate personnel scheduling and duty assignments across multiple operational shifts and mission sets
• Conduct operational readiness assessments and capability gap analysis
• Support technical hiring, training, and professional development to maintain mission-critical capabilities
• Foster mission-focused operational culture emphasizing vigilance, technical proficiency, and team coordination

Mission Coordination & Stakeholder Engagement

• Interface directly with military cyber operations teams, intelligence analysts, and mission partners on operational matters
• Ensure alignment with mission priorities, operational tempo, and threat intelligence from Intelligence Community stakeholders
• Provide situational awareness and operational status updates to program leadership and customers
• Support planning and execution of defensive cyber operations including coordinated hunts and incident response
• Present operational updates and threat briefings to C-suite and senior government leadership
• Build and maintain strong operational relationships that enhance mission effectiveness and information sharing
• Coordinate with Network Operations Centers (NOCs), SOCs, and Cyber Operations Centers across the enterprise

Operational Performance & Metrics Management

• Track and report on defensive cyber operations metrics including detection rates, mean time to detect (MTTD), mean time to respond (MTTR), and threat containment effectiveness
• Generate regular operational reports on threat activity, incident response performance, and defensive posture
• Identify operational trends through threat intelligence analysis and implement proactive defensive measures
• Support after-action reviews (AARs) and lessons learned processes to improve operational effectiveness
• Maintain operational documentation including standard operating procedures (SOPs), playbooks, and run books
• Provide executive-level reporting on operational readiness and threat landscape
• Ensure Service Level Agreement (SLA) compliance for detection, response, and escalation timelines

Capability Development & Training

• Assess and develop team capabilities to meet evolving threat landscape and mission requirements
• Recommend training and professional development opportunities including certifications, technical training, and operational exercises
• Support integration of new tools, techniques, and procedures (TTPs) into defensive operations
• Lead operational training exercises and tabletop exercises to maintain team proficiency
• Foster culture of continuous learning, threat intelligence sharing, and operational innovation
• Develop and maintain threat-informed defensive strategies and operational concepts

Technical Operations & System Integration

• Oversee operation of SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR solutions, and defensive cyber tools
• Ensure integration and operational effectiveness of threat detection, hunting, and response technologies
• Support tuning and optimization of detection content, correlation rules, and alert workflows
• Coordinate with engineering teams on tool deployment, configuration, and operational support
• Maintain situational awareness of network architecture, critical assets, and defensive coverage
• Support continuous monitoring requirements for accredited systems and compliance with IA standards

Operational Risk Management & Mission Assurance

• Identify, assess, and aggressively mitigate operational risks in mission environments where undetected intrusions could compromise critical operations
• Develop and implement tactical response procedures and escalation protocols for cyber incidents
• Ensure operational continuity during high-threat periods, system outages, or personnel transitions
• Navigate operational constraints while maintaining unwavering mission focus and defensive posture
• Support crisis management during major incidents, advanced persistent threats (APTs), or coordinated attacks
• Balance operational tempo with sustainable operations and team well-being during extended operations

Required Qualifications Education & Certification

• Bachelor's or Master's degree in Computer Science, Cybersecurity, IT, or related STEM field
• Security+ and at least one: CISSP, CISM, CCISO, GCDA, CE, CySA+, or equivalent certification

Experience

• Defensive Cyber Operations Leadership (One of the following):
• 10+ years cybersecurity operations experience with demonstrated operational leadership of defensive cyber teams
• 8+ years leading SOC operations or cyber defense missions for programs of similar size and scope (50+ FTEs, $50M+ budgets)
• 10+ years conducting cyber incident response, threat hunting, or network defense operations supporting national security missions

Domain Experience (One of the following):

• 5-8 years cybersecurity, SOC, or cyber incident response experience with operational focus
• 5-8 years detection engineering and automation experience
• 5-8 years cyber operations or threat hunting with Intelligence Community customers

Technical Knowledge

• Deep understanding of defensive cyber operations, threat detection methodologies, and incident response processes
• Demonstrated experience with programs of similar size and scope supporting Intelligence Community missions
• Extensive knowledge of cyber threats, attack vectors, TTPs, and adversary behavior including nation-state and APT groups
• Strong understanding of SOC operations, shift management, and operational battle rhythm for 24/7/365 environments
• Experience with SIEM platforms (Splunk, Elastic, Sentinel), EDR/XDR tools, and defensive cyber technologies
• Working knowledge of threat intelligence platforms, threat hunting methodologies, and MITRE ATT&CK framework
• Familiarity with network security monitoring, log analysis, and forensic investigation techniques
• Understanding of Cyber Operations and partner cyber mission teams

Leadership & Stakeholder Management

• Exceptional operational leadership skills with proven ability to lead teams under high-pressure, high-tempo conditions
• Demonstrated success in mission environments requiring rapid operational decision-making and tactical leadership
• Tr