Threat and Research Technical Project Manager

About the Role

We are seeking an experienced Technical Project Manager to join our Security Operations Center (SOC) team to lead advanced threat and research functions. This role leads advanced analytics, threat hunting, cyber threat intelligence, malware analysis, and forensic support across all customer enterprise environments, including on‑prem, zero trust, and cloud environments. The Threat and Research (T&R) Lead serves as the primary operational, analytical, and strategic coordinator for T&R functions and is the designated point of contact for escalations, reporting, inter‑team coordination, and alignment with customer cybersecurity directives. The T&R Lead will guide proactive and innovative approaches to identifying, mitigating, and investigating advanced threats targeting networks, systems, and mission spaces. The role requires deep technical expertise, strong leadership, and the ability to communicate complex findings to senior executives, cybersecurity leadership, and technical teams across the enterprise.

Responsibilities

• Support SOC consolidation, Intake, and SOC Services activities
• Lead proactive threat hunting activities across environments to detect advanced and emerging cyber threats
• Oversee the optimization of the Threat Intelligence Platform for automated ingestion, enrichment, and distribution
• Lead advanced malware analysis, reverse engineering efforts, and malicious code investigations
• Participate in a periodic on‑call rotation and provide timely response to incidents as they arise

Requirements

• 10+ years of experience with cybersecurity in threat hunting, threat intelligence, malware analysis, digital forensics, or SOC operations
• Experience leading advanced cyber threat research efforts in enterprise environments
• Experience with Splunk, including complex queries, dashboards, and content development
• Experience with endpoint detection platforms, including CrowdStrike, Microsoft Defender, or FireEye MX
• Experience with packet capture analysis and forensic tools
• Experience with threat intelligence platforms, including MISP, and SIEM integration
• Knowledge of CNE and CNA tools and tradecraft along with signatures, tactics, techniques, and procedures associated with preparation for and execution and implementation of such attacks
• Knowledge of adversary TTPs, cyber kill chains, threat modeling frameworks, including MITRE ATT&CK, STRIDE, or PASTA, and nation‑state threat actors
• Ability to draft high‑quality reports, briefings, technical assessments, and executive summaries
• Top Secret clearance
• Bachelor’s degree

Preferred Qualifications

• Experience coordinating with government agencies and Intelligence Community partners
• Experience with ServiceNow or similar ticketing systems
• Ability to write and deliver succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences
• Knowledge of current and emerging cyber adversaries and their techniques, tactics, and procedures (TTPs)
• CISSP, GCTI, GCIA, GCIH, CEH, CTIA, or equivalent certification

Clearance

Top Secret clearance is required. Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information.

Benefits

• Health, life, disability, financial, and retirement benefits
• Paid leave, professional development, tuition assistance, work‑life programs, and dependent care
• Recognition awards program for exceptional performance and superior demonstration of values
• Full‑time and part‑time employees working at least 20 hours a week on a regular basis are eligible to participate in benefit programs

Pay

The projected compensation range for this position is $99,000.00 to $225,000.00 (annualized USD). Salary is determined by various factors including location, education, knowledge, skills, competencies, experience, contract‑specific affordability, and organizational requirements.

Work Model

This position may be remote, hybrid, or onsite. Remote roles may still require occasional in‑person work at a Booz Allen or customer facility. Hybrid roles require work from a Booz Allen or customer facility in alignment with leadership expectations and role needs. Onsite roles are performed full‑time at a customer facility. The role requires participation in a periodic on‑call rotation.