Security Operations Team Lead
Virginia Department of Taxation · Richmond, VA · 1 mo ago
Hybrid$120k–$140k/yrFull-time
We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. Must not repeat job title as heading. Must not include Job ID etc. Must preserve all substantive info. Remove boilerplate like EEO, legal, application instructions, etc.
We need to parse the posting.
Title: Security Operations Team Lead
State Role Title: Information Security Analysts (maybe not needed)
Hiring Range: $120,000 - $140,000
Pay Band: 6
Agency: Department of Taxation
Location: Main Street Center
Agency Website: https://www.tax.virginia.gov/work-with-us
Recruitment Type: General Public - G
Then "Job Duties" paragraph: description.
Then "About the Role" heading with content.
Then after that, there is a paragraph about hybrid schedule: "The position is located at our Main Street Centre location in Richmond Virginia and has a hybrid schedule consisting of 3 days in the office (Tuesday, Wednesday, Thursday) and 2 days teleworking (Monday and Friday). Candidate must reside within 50 miles of the Richmond office to be eligible for this role."
Then "The salary range for this position is $120,000 to $140,000 commensurate with knowledge, skills, abilities and experience."
Then benefits bullet list.
Then "At Virginia Tax…" paragraph (maybe not needed but could be considered part of About? It's fluff but maybe keep as part of About? It's not specific duties; but we can keep as part of About the role? It's more about culture; maybe we can include in About the role? But we must not create filler. It's substantive? It's generic but maybe we can keep as part of About the role? The instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text. The "At Virginia Tax…" is generic fluff but still content; not placeholder like "commensurate with experience". It's okay.
Then Minimum Qualifications heading with list.
Then Additional Considerations heading with list.
Then "Selected candidate(s) will be required to consent..." etc. That's boilerplate legal/EEO etc. Should be removed.
Also "Selected candidates require a valid Driver’s License." Might be considered a requirement? It's a specific requirement. Could be included in Requirements or Qualifications. It's a specific condition. We'll keep.
Also "The selected candidate will be prohibited from performing tax or accounting services for compensation during or outside business hours." That's a specific condition; could be included in Requirements.
Also "Virginia Tax is an equal opportunity employer..." etc. That's boilerplate EEO; remove.
Also "Reasonable accommodations..." etc. Remove.
Also "Virginia Tax participates in E-verify." Remove.
Also "Consideration for an interview is based solely on the information within the application and/or resume’." Remove.
Also "In support of the Commonwealth’s commitment to inclusion..." Remove.
Also "Veterans are encouraged..." Remove.
Also "If you need to get a Certificate of Disability..." Remove.
Thus we need to extract sections:
- About the role: we have a heading "About the Role" with paragraph content. We'll keep that as
About the role
then... (the paragraph after that heading). The paragraph includes: "As the Security Operations Team Lead, you will be part of a mission driven cybersecurity team dedicated to protecting the agency's systems and data. You will demonstrate strong leadership and deep technical expertise while supervising and developing Security Analysts responsible for frontline monitoring and incident response, you will:" then a list of duties (starting with "Lead daily security monitoring..."). We need to decide where to put the list of duties. According to rules, we should use
- for any list of duties/requirements/benefits. So after the About the role paragraph, we should have a
- with the duties listed.
But the posting already has a list after "you will:" with each duty as a sentence starting with a verb. We'll extract each as
- .
List items:
- Lead daily security monitoring and incident response activities, ensuring threats are identified, analyzed, prioritized, and remediated in alignment with agency standards.
- Provide hands-on leadership by guiding analysts through investigations, escalations, containment actions, and coordinated response efforts.
- Prioritize and tune SIEM alerts, refine detection logic, and reconcile daily monitoring results to maintain a robust and accurate security posture.
- Oversee log ingestion health and data integrity across Splunk and other monitoring platforms, validating sources, diagnosing ingestion issues, and coordinating with system owners to restore visibility.
- Leverage AI-assisted security analytics tools to enhance threat detection accuracy, reduce false positives, and accelerate triage within the SOC environment.
- Evaluate and implement AI-driven automation to improve alert correlation, anomaly detection, and incident enrichment while ensuring compliance with agency security standards.
- Oversee CyberArk Privileged Access Management (PAM) operations, including least privilege enforcement, credential rotation, privileged account monitoring, and secure onboarding of service accounts.
- Manage CyberArk or BeyondTrust Endpoint Privilege Management (EPM) processes, including elevation rule design, policy tuning, auditing, and balancing security controls with user productivity.
- Support cloud security operations through services such as CloudTrail and Security Hub, ensuring effective detection of misconfigurations, anomalies, and unauthorized activity.
- Collaborate with system administrators, application teams, cloud teams, and third-party vendors to integrate security controls, strengthen infrastructure, and ensure secure system configurations.
- Develop, maintain, and improve security playbooks, workflows, and procedures to ensure consistency, readiness, and alignment with frameworks such as SEC 530, NIST, CIS Controls, and MITRE ATT&CK.
- Drive continuous improvement through integration of threat intelligence, periodic security posture assessments, and enhancement of detection and response capabilities across the SOC.
That's the duties.
Now after that, there is a paragraph about hybrid schedule and location. That could go under Schedule section (if we have schedule info). Also location maybe not needed as heading but could be part of About? But we have a Schedule section for hybrid schedule. Also we have Pay section for salary range.
We also have Benefits section with bullet list.
We also have Requirements/Qualifications/Skills sections. We need to decide how to split.
Minimum Qualifications heading with list items:
- Demonstrated leadership experience guiding and mentoring security analysts, including providing hands‑on direction during investigations, escalations, and containment activities.
- Strong, hands‑on experience performing daily security monitoring and incident response, including identifying, analyzing, prioritizing, and remediating cyber threats.
- Practical experience applying security frameworks such as NIST, CIS Controls, SEC 530, and MITRE ATT&CK to develop, maintain, and improve SOC playbooks and workflows.
- Experience tuning SIEM alerts, refining detection logic, reconciling monitoring results, and ensuring accuracy of security event and log data.
- Experience supporting cloud security operations using tools such as AWS CloudTrail and Security Hub to detect misconfigurations, anomalies, and unauthorized activity.
- Ability to collaborate effectively with system administrators, application teams, cloud teams, and vendors to integrate and strengthen security controls across multiple environments.
That's qualifications.
Additional Considerations heading with list:
- Experience using AI‑assisted detection, correlation, or analysis tools within a SOC.
- Familiarity with integrating AI into SIEM, SOAR, or cloud‑native security platforms.
- Industry certification in Information Security such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Offensive Security Certified Professional or Expert (OSCP or OSCE), or Certified Ethical Hacker (CEH), AWS Certified Cloud Practitioner, AWS Certified Security
We could treat these as Skills or Additional Qualifications. The instruction: use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content to these headings.
We have:
- About the role: we already have.
- Responsibilities: could be the duties list (the same as we extracted). Or we could put duties under Responsibilities. The About the role paragraph could be a brief description; responsibilities list under Responsibilities.
- Requirements: maybe the Minimum Qualifications.
- Qualifications: maybe the Additional Considerations? Or we could combine.
- Skills: maybe the certifications and AI experience etc.
But we need to avoid thin sections. Let's think: we have duties (responsibilities), minimum qualifications (requirements), additional considerations (maybe skills/certifications). We could have:
- About the role (description)
- Responsibilities (duties list)
- Requirements (minimum qualifications)
- Skills (additional considerations: AI experience, certifications)
- Benefits (benefits list)
- Pay (salary range)
- Schedule (hybrid schedule and location)
We should not include Qualifications heading if we already have Requirements and Skills; but we could also have Qualifications as a separate section for something else. However we have no other qualifications besides those. Could merge Minimum Qualifications into Requirements, and Additional Considerations into Skills.
Thus sections:
About the role
As the Security Operations Team Lead, you will be part of a mission driven cybersecurity team dedicated to protecting the agency's systems and data. You will demonstrate strong leadership and deep technical expertise while supervising and developing Security Analysts responsible for frontline monitoring and incident response, you will:
Then- with duties.
But note: the About the role paragraph ends with "you will:" and then the list. If we put the paragraph ending with "you will:" and then list, it's okay.
Alternatively we could incorporate the "you will:" into the list items; but we need to preserve all substantive information. The phrase "you will:" is part of the intro; we can keep it in the
as is. Now Responsibilities: maybe we could avoid duplication; but we already put duties under About the role. The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It suggests we could have both About the role and Responsibilities sections. But we must not emit a heading followed by filler/placeholder text. If we put duties under Responsibilities, we could keep About the role paragraph only (without the list). Then Responsibilities heading with the list. That seems better: About the role: short paragraph describing role; Responsibilities: list of duties. Thus:
About the role
As the Security Operations Team Lead, you will be part of a mission driven cybersecurity team dedicated to protecting the agency's systems and data. You will demonstrate strong leadership and deep technical expertise while supervising and developing Security Analysts responsible for frontline monitoring and incident response.
ThenResponsibilities
- with the duty items.
Now Requirements: Minimum Qualifications list.
Requirements
- with the six items.
Now Skills: Additional Considerations list (AI experience, certifications). Could also include "Ability to collaborate effectively..." but that's already in Requirements. So Skills:
Skills
- with three items.
Now Benefits: bullet list from posting.
Benefits list:
- Job stability and quality of life! Enjoy your work/life balance with flexible schedule options and up to two days of telework per week.
- 12 Paid State holidays on top of vacation, sick, volunteer, and personal leave!
- Comprehensive and affordable health benefits.
- Got student loans? You may be eligible for the Public Service Loan Forgiveness program.
- Participation in the Virginia Retirement System, VA 457 Deferred Comp, and more.
We need to keep the exclamation marks etc. It's okay.
Now Pay: salary range: $120,000 - $140,000. Also mention Pay Band: 6 maybe? Could include but not required
- .
List items:
- Lead daily security monitoring and incident response activities, ensuring threats are identified, analyzed, prioritized, and remediated in alignment with agency standards.
- Provide hands-on leadership by guiding analysts through investigations, escalations, containment actions, and coordinated response efforts.
- Prioritize and tune SIEM alerts, refine detection logic, and reconcile daily monitoring results to maintain a robust and accurate security posture.
- Oversee log ingestion health and data integrity across Splunk and other monitoring platforms, validating sources, diagnosing ingestion issues, and coordinating with system owners to restore visibility.
- Leverage AI-assisted security analytics tools to enhance threat detection accuracy, reduce false positives, and accelerate triage within the SOC environment.
- Evaluate and implement AI-driven automation to improve alert correlation, anomaly detection, and incident enrichment while ensuring compliance with agency security standards.
- Oversee CyberArk Privileged Access Management (PAM) operations, including least privilege enforcement, credential rotation, privileged account monitoring, and secure onboarding of service accounts.
- Manage CyberArk or BeyondTrust Endpoint Privilege Management (EPM) processes, including elevation rule design, policy tuning, auditing, and balancing security controls with user productivity.
- Support cloud security operations through services such as CloudTrail and Security Hub, ensuring effective detection of misconfigurations, anomalies, and unauthorized activity.
- Collaborate with system administrators, application teams, cloud teams, and third-party vendors to integrate security controls, strengthen infrastructure, and ensure secure system configurations.
- Develop, maintain, and improve security playbooks, workflows, and procedures to ensure consistency, readiness, and alignment with frameworks such as SEC 530, NIST, CIS Controls, and MITRE ATT&CK.
- Drive continuous improvement through integration of threat intelligence, periodic security posture assessments, and enhancement of detection and response capabilities across the SOC.
That's the duties.
Now after that, there is a paragraph about hybrid schedule and location. That could go under Schedule section (if we have schedule info). Also location maybe not needed as heading but could be part of About? But we have a Schedule section for hybrid schedule. Also we have Pay section for salary range.
We also have Benefits section with bullet list.
We also have Requirements/Qualifications/Skills sections. We need to decide how to split.
Minimum Qualifications heading with list items:
- Demonstrated leadership experience guiding and mentoring security analysts, including providing hands‑on direction during investigations, escalations, and containment activities.
- Strong, hands‑on experience performing daily security monitoring and incident response, including identifying, analyzing, prioritizing, and remediating cyber threats.
- Practical experience applying security frameworks such as NIST, CIS Controls, SEC 530, and MITRE ATT&CK to develop, maintain, and improve SOC playbooks and workflows.
- Experience tuning SIEM alerts, refining detection logic, reconciling monitoring results, and ensuring accuracy of security event and log data.
- Experience supporting cloud security operations using tools such as AWS CloudTrail and Security Hub to detect misconfigurations, anomalies, and unauthorized activity.
- Ability to collaborate effectively with system administrators, application teams, cloud teams, and vendors to integrate and strengthen security controls across multiple environments.
That's qualifications.
Additional Considerations heading with list:
- Experience using AI‑assisted detection, correlation, or analysis tools within a SOC.
- Familiarity with integrating AI into SIEM, SOAR, or cloud‑native security platforms.
- Industry certification in Information Security such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Offensive Security Certified Professional or Expert (OSCP or OSCE), or Certified Ethical Hacker (CEH), AWS Certified Cloud Practitioner, AWS Certified Security
We could treat these as Skills or Additional Qualifications. The instruction: use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content to these headings.
We have:
- About the role: we already have.
- Responsibilities: could be the duties list (the same as we extracted). Or we could put duties under Responsibilities. The About the role paragraph could be a brief description; responsibilities list under Responsibilities.
- Requirements: maybe the Minimum Qualifications.
- Qualifications: maybe the Additional Considerations? Or we could combine.
- Skills: maybe the certifications and AI experience etc.
But we need to avoid thin sections. Let's think: we have duties (responsibilities), minimum qualifications (requirements), additional considerations (maybe skills/certifications). We could have:
- About the role (description)
- Responsibilities (duties list)
- Requirements (minimum qualifications)
- Skills (additional considerations: AI experience, certifications)
- Benefits (benefits list)
- Pay (salary range)
- Schedule (hybrid schedule and location)
We should not include Qualifications heading if we already have Requirements and Skills; but we could also have Qualifications as a separate section for something else. However we have no other qualifications besides those. Could merge Minimum Qualifications into Requirements, and Additional Considerations into Skills.
Thus sections: