Cyber Security Lead

About the role

A Cybersecurity Lead will set strategic directions and oversight for the entire Assessment & Authorization and Vulnerability Management teams, including A&A Analysts, A&A Specialists, A&A SMEs, A&A Security Engineers, A&A Architects, Vulnerability Management Analysts, and Vulnerability Management Engineers to deliver the cyber authorization services.

Responsibilities

• Develop project management plans such as Work Breakdown Structure, mentor and guide team members on the preparation of technical deliverables and resolve project issues, prepares progress/status reports on technical deliverables, and monitor contractual requirements bringing in help from outside the project as needed to mitigate risks.
• Serve as a primary interface for the client and ASM leadership to answer questions, address concerns, and provide status/updates.
• Manage the shift work analysts, develop training plans, develop and approve SLA monitoring solutions, ensure ongoing analyst certification, conduct employee performance evaluations, and provide overall strategic direction for the SOC.
• Implement and oversee baseline security configurations and controls. Monitor and report on cybersecurity metrics, ensuring compliance with DOE and federal requirements.
• Review and update processes to align with OIM guidance, policy, and best practices. Lead the implementation of the OIM cybersecurity metrics program plan, including data collection, reporting, and oversight.
• Direct daily cybersecurity operations for SC GSS domains, including detection, analysis, containment, eradication, and recovery. Manage SIEM, IDS/IPS, EDR, DLP, ICAM, CDM, and cloud security tools.
• Provide daily cyber health and status reports to leadership. Lead proactive threat hunting and incident response, coordinating with DOE’s iJC3.
• Establish and maintain SOPs for incident response, escalation, and after-action reporting. Ensure compliance with DOE Order 205.1, US-CERT requirements, and federal directives.
• Oversee CDM program activities, including tool maintenance, upgrades, and analysis. Coordinate with DOE contractors and vendors to ensure compliance with DOE Orders and regulations.
• Provide continuous monitoring for unauthorized hardware/software and applied risk controls. Lead vulnerability identification, risk assessment, and mitigation across IT infrastructure and cloud environments.
• Direct patch management, configuration updates, and corrective actions. Establish continuous monitoring processes leveraging automated tools and threat intelligence feeds.
• Ensure compliance with FISMA, NIST 800-53, and evolving regulatory requirements. Deliver regular vulnerability management reports with metrics, compliance status, and recommendations.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or related field (Master’s preferred).
• 8+ years of progressive experience in cybersecurity operations, incident response, and vulnerability management.
• Certifications such as CISSP, CISM, CEH, or equivalent.
• GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), Certified Information System Security Professional or Associate (CISSP or Associate), ISC2 Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Project Management Professional (PMP), Certified Associate in Project Management (CAPM).

Skills

• Strong knowledge of DOE cybersecurity policies, federal directives, and industry best practices.
• Hands-on expertise with SIEM, IDS/IPS, EDR, DLP, ICAM, CDM, and cloud security platforms.
• Proven leadership in managing cross-functional teams.
• Experience with: NIST 800-53 Rev 5, Risk Management Framework, NIST Cybersecurity Framework (CSF), FedRAMP Authorization, Tenable Nessus (ACAS), and DISA STIGs.