[Hiring] Security Operations Manager @Chenega MIOS

Role Description

The SecOps Manager serves as an on-floor subject matter expert supporting Google Public Sector’s (GPS) 24/7/365 Tier 1 security operations in sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across Google sovereign infrastructure and air-gapped offerings. The manager leads shift operations, coaches analysts, pre-screens technical escalations to Google SecOps engineering, and drives security playbook and alert-tuning improvements while ensuring high-confidence triage, timely responses, and continued partner ownership of incidents.

Responsibilities

• Lead on-floor Tier 1 security operations and coach analysts in monitoring GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools, Splunk, ELK, designated SIEM systems, and EDR tools.
• Oversee initial GPS customer and incident-reporting support, including email and support portals. Ensure alerts are acknowledged within 5 minutes of creation and receive a First Meaningful Response (FMR) within 15 minutes for High/Critical alerts and 25 minutes for all others.
• Guide incident-detail collection, severity categorization, event enrichment, and correlation. Validate evidence and disposition justifications for high-confidence triage and ensure all true positives are escalated to the appropriate Google SecOps representative per procedures and runbooks.
• Ensure partner ownership of ServiceNow incidents, investigations, customer updates, follow-on actions, and required government incident-report drafts continues during Google technical consults.
• Pre-screen technical consults during core hours using analyst summaries of Observed Activity, Playbooks/Queries Run, IOCs, and Proposed Disposition.
• Drive playbook development, validation, and continuous improvement with engineering teams.
• Coordinate operational coverage with the on-shift team to maintain at least two active personnel and at least one FTE in each occupied SecOps room.
• Serve as live Queue Manager or ensure a designated senior on-shift analyst fills the role each shift.
• Attend requested customer situational awareness calls and ensure noteworthy information and tasking are relayed through designated channels within 1 hour.
• Coordinate weekly activity reporting due Friday by 15:00 EDT, covering alert response SLA compliance, triage dispositions, playbooks validated/updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing.
• Other duties as assigned.

Qualifications

• 5+ years of experience in security operations (SOC) or incident response, including leading shift operations, pre-screening technical escalations, coaching security analysts, and partnering with engineering teams on SIEM detection tuning and playbook development.
• Strong hands-on experience with SIEM, IDS, EDR, and case management or ticketing tools.
• Technical experience supporting Windows and Linux operating systems, networking infrastructure, scripting, and security application troubleshooting.
• Possess and maintain an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification before starting billable work (e.g., CySA+, GCIA, GCIH, CEH, or CISSP).
• Successfully complete Google’s extended workforce onboarding process and maintain required government-contract compliance, including mandatory training.
• Active TS/SCI with Full Scope Polygraph.
• Successfully pass background and drug screening.

Preferred Qualifications

• Bachelor’s degree in cybersecurity or computer science, or equivalent practical experience.
• Experience in a dedicated SOC, including event analysis using Splunk, ELK, or other SIEM systems.
• Hands-on security detection development and alert tuning in partnership with Tier 2 and Tier 3 engineering teams, supporting continuous improvement of SOC playbooks.
• Experience compiling threat reports that translate complex indicators of compromise (IOCs) into clear narrative overviews for customer and technical audiences.
• Advanced understanding of LAN/WAN topologies, Google Cloud Platform, Kubernetes, and air-gapped computing environments.
• Experience operating in classified SCIF environments, handling sensitive or classified data, or supporting cloud environments.
• Elastic Certified SIEM Analyst or Splunk Core Certified User certification.

Knowledge, Skills and Abilities

• General knowledge of network analysis, vulnerability scanning (e.g., Nessus), security hardening best practices (e.g., DISA STIG), and vulnerability landscapes (e.g., OWASP Top 10).
• Foundational understanding of LAN/WAN topologies, Kubernetes, and air-gapped computing environments.
• Clear technical and customer communication; ability to explain incident findings, review diagnostic summaries and reports, and provide actionable coaching to analysts.
• Ability to lead collaboratively in classified, mission-critical environments, safeguard sensitive information, and reinforce security procedures, approved runbooks, and escalation protocols.
• Sound operational judgment and prioritization; ability to oversee live queues, recognize approaching SLA deadlines, direct timely follow-on actions, and maintain accurate incident and shift records.
• Strong analytical and troubleshooting skills to assess SIEM/EDR findings, correlate evidence, validate triage justifications, and pre-screen technical escalations for Google SecOps engineering.
• Ability to reinforce end-to-end partner incident ownership during consults, sustain customer updates, and ensure complete, immediately accepted High/Critical shift handoffs.
• Ability to coach analysts, identify recurring noisy alerts and broken playbooks, and partner with engineering teams on detection tuning, playbook development, and operational improvement.
• Ability to support 24/7/365 operations, including overnight, weekend, and holiday coverage, coordinate room presence, and adapt to changing mission needs and operational disruptions.

Benefits

• Opportunities for professional development and skill sharpening.
• Positive and supportive culture that encourages team members to do their best work.
• Well-being programs and flexibility to maintain a healthy work-life balance.
• Commitment to corporate citizenship and positive social impact in communities.