NETWORK OPERATIONS CENTER · CYBER TEAM LEAD
Department of Energy / NNSA · Hybrid: Washington, DC → Manassas, VA · Panama Shift Schedule
WHY THIS ROLE STANDS OUT
Panama Shift Schedule — Work just 15 days a month. 12-hour shifts on a rotating 4-on/3-off, then 3-on/4-off cadence — meaning every other weekend is a 4-day weekend, with built-in long stretches of time off.
Temporary Hybrid Flexibility — Until the Manassas facility is accredited and cleared, you'll split each workday: half remote from home, half on-site at 1000 Independence Ave SW. A rare hybrid option for a cleared SOC leadership role.
POSITION DETAILS
Work Mode:
Hybrid (Temporary) → 100% On-Site
Current (Temporary) Location:
1000 Independence Ave. SW, Washington, DC 20585
Future Permanent Location:
9400 Godwin Dr, Manassas, VA 20110
Shift Schedule:
Panama Schedule — 12-hour shifts, rotating 4-on/3-off then 3-on/4-off (NOC operates 24x7x365)
Employment:
Full-Time
Duration:
Long Term Contract
Start Date:
ASAP — new hire start dates: 1st and 16th of each month
Pay Rate (DL):
NTE $84.68 / hour
Clearance:
Top Secret (investigation current within last 5 years) — REQUIRED
WORK ARRANGEMENT
Temporary Hybrid Setup
This position currently operates in a hybrid arrangement. Each workday is split — approximately half a day worked remotely from home and half a day on-site at 1000 Independence Ave. SW, Washington, DC. This hybrid flexibility is temporary and remains in place until the Manassas, VA facility (9400 Godwin Dr) is accredited and cleared. Once the Manassas site is fully cleared, this position transitions to 100% on-site at that location.
Panama Shift Schedule
The NOC operates 24x7x365 on a Panama shift schedule built around 12-hour shifts and a rotating, balanced work/rest cycle. Across a two-week rotation, you work only 15 days per month and enjoy frequent multi-day stretches off — including a recurring four-day weekend.
Week Pattern
Week A
Work 4 days / Off 3 days (12-hour shifts)
Week B
Work 3 days / Off 4 days (12-hour shifts)
Net result: predictable scheduling, half the commute days, and substantially more time off than a standard Monday–Friday role.
ABOUT THE ROLE
The NOC Cyber Team Lead plays a pivotal role in managing the Security Operations Center, guiding the SOC team, and ensuring effective detection and response to cybersecurity incidents. Leveraging deep technical expertise, this individual will identify risks, improve methodologies, and protect the organization's intellectual property from evolving threats. The role demands a combination of leadership, technical skill, and the ability to communicate complex cybersecurity issues to diverse stakeholders.
ROLES & RESPONSIBILITIES
Leadership & Team Management
▪ Lead, manage, and mentor the SOC team, ensuring day-to-day operations run smoothly and efficiently.
▪ Provide guidance, feedback, and training to SOC analysts to improve performance and skillset.
▪ Ensure 24/7 operational readiness of the SOC, including shift coverage and resource management across the Panama rotation.
Incident Response & Management
▪ Lead the SOC team in identifying, analyzing, and responding to cybersecurity incidents — including intrusions, malware, and data breaches.
▪ Reconstruct event timelines using network defense data to analyze intrusions and attacks.
▪ Serve as the escalation point for complex or high-priority incidents, ensuring proper handling and resolution.
▪ Support enterprise-wide incident response in collaboration with IT and cybersecurity teams.
▪ Continuously strengthen incident response methodologies to improve response times and effectiveness.
Threat Detection & Mitigation
▪ Develop and support threat detection capabilities to proactively identify emerging risks and vulnerabilities.
▪ Analyze large volumes of network traffic, system logs, and threat intelligence data to uncover potential threats.
▪ Leverage network operations expertise to predict attack vectors and devise proactive defense strategies.
▪ Provide recommendations on improving threat data collection and ensuring high-quality data availability for analysis.
Cybersecurity Risk Analysis
▪ Analyze cybersecurity risks and communicate findings to key decision-makers in a clear, concise manner.
▪ Translate complex technical risks into actionable insights for non-technical stakeholders, including senior leadership.
▪ Assist in identifying areas for continuous improvement in the organization's cybersecurity practices.
Intellectual Property Protection
▪ Safeguard the organization's intellectual property by identifying threats and vulnerabilities that could put sensitive data at risk.
▪ Develop and implement strategies to mitigate risks to intellectual property and other sensitive assets.
Collaboration & Communication
▪ Collaborate with internal teams — IT, network security, and engineering — to ensure cohesive threat response strategies.
▪ Serve as the subject matter expert for security incidents, threat analysis, and response processes within the SOC.
▪ Keep organizational leadership and relevant stakeholders informed of critical cybersecurity events and decisions.
Security Tool Management & Optimization
▪ Oversee configuration, optimization, and management of security tools including SIEM, IDS/IPS, endpoint protection, and monitoring solutions.
▪ Ensure security tools are appropriately tuned to detect relevant threats and provide effective coverage across all systems.
Reporting & Documentation
▪ Maintain accurate and detailed documentation of security incidents — analysis, findings, and mitigation steps.
▪ Prepare incident reports, post-mortem analyses, and regular updates to senior management on SOC performance and emerging threats.
▪ Ensure compliance with industry standards and regulatory requirements in incident documentation and reporting.
Continuous Improvement & Best Practices
▪ Foster a culture of continuous improvement by assessing performance metrics, conducting after-action reviews, and implementing process improvements.
▪ Stay current with the latest cybersecurity threats, trends, and best practices to ensure SOC alignment with industry standards.
REQUIRED QUALIFICATIONS
▪ Experience: 10+ years in cybersecurity, with at least 4 years in a leadership role within a SOC or security operations environment.
▪ Certifications: CISSP, CISM, GCIH, GCIA, or equivalent cybersecurity certifications strongly preferred.
▪ Technical Expertise: Proven expertise in network defense, incident response, threat detection, vulnerability management, and security operations.
▪ Incident Response: Strong experience leading incident response efforts — network intrusions, malware infections, and data breaches.
▪ Data Analysis: Experience analyzing large data volumes (network traffic, logs, threat intelligence) to identify and respond to cybersecurity risks.
▪ Leadership Skills: Demonstrated ability to lead and mentor a team, manage operations, and communicate complex security issues to both technical and non-technical stakeholders.
▪ Communication: Exceptional written and verbal communication skills; able to present technical information clearly to senior leadership.
ADDITIONAL QUALIFICATIONS
▪ Strong understanding of network operations and how adversaries exploit network environments.
▪ Ability to predict potential attack vectors based on current threat intelligence and historical data.
▪ Strong analytical skills — able to translate complex data into actionable insights for decision-makers.
▪ Experience with intellectual property protection strategies and threat data collection methodologies.
TECHNICAL ENVIRONMENT
Microsoft · Linux · Splunk · Ansible · Tenable · Wireshark
NON-NEGOTIABLE REQUIREMENTS
▪ Active Top Secret clearance with investigation current within the last 5 years.
▪ Hybrid work mode is temporary; position transitions to 100% on-site at the Manassas, VA location once that facility is accredited and cleared.
▪ Must be able to work the Panama shift schedule, including 12-hour shifts on a rotating 4-on/3-off and 3-on/4-off cycle, supporting 24x7x365 NOC operations.
▪ New hire start dates are the 1st and 16th of each month.
HOW SUCCESS IS MEASURED
Performance in this role will be evaluated across the following key areas:
▪ Incident Response Metrics: Speed and effectiveness of threat detection, containment, and resolution.
▪ Threat Detection & Prevention: Reduction in false positives, proactive threat identification, and tool improvement.
▪ Team Leadership: Team performance, retention, and success in analyst mentoring and training.
▪ Collaboration & Communication: Cross-department cooperation, reporting clarity, and stakeholder confidence.
▪ Continuous Improvement: Process optimization, post-incident review outcomes, and enhanced security posture.
▪ Compliance & Audit: Adherence to regulatory requirements and favorable audit results.
▪ Tool & Technology Utilization: Effective use of security tools with measurable ROI.
IMPORTANT NOTICES
Drug Testing, Background Investigation & Counterintelligence Evaluation Notice
Prospective applicants are hereby notified that reviews and tests for the absence of any illegal drug as defined in 10 CFR 707.4 will be conducted by the employer. A background investigation by the Federal government may be required to obtain an access authorization prior to employment, and subsequent reinvestigations may be required. This position is covered by the Counterintelligence Evaluation Program regulations at 10 CFR Part 709. Applicants are advised that successful completion of a counterintelligence evaluation may include a counterintelligence-scope polygraph examination.
This position and all hiring decisions will be made without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status.
As a federal contractor, Intrinsic Resolution, LLC complies with Section 503 of the Rehabilitation Act and VEVRAA. No disability-related inquiries will be made prior to a conditional offer of employment, except as permitted by applicable law.
Employee Rights Under the National Labor Relations Act (NLRA): As a federal contractor, the Company complies with Executive Order 13496 and informs employees of their rights under the NLRA. Information is available at the workplace and from the National Labor Relations Board.
This position is covered by the Service Contract Labor Standards (SCLS). Compensation and fringe benefits will be provided in accordance with the applicable U.S. Department of Labor wage determination and any applicable collective bargaining agreement.
Pay: $80.00 - $86.68 per hour
Benefits:
- 401(k) matching
- Dental insurance
- Health insurance
- Paid time off
- Vision insurance
Experience:
- Cybersecurity: 10 years (Required)
- Splunk: 3 years (Required)
- Wireshark: 3 years (Required)
- Data Analysis: 5 years (Required)
- Leadership: 4 years (Required)
- working in a NOC or SOC environment: 2 years (Required)
License/Certification:
- CISSP, CISM, GCIH, GCIA or equivalent (Preferred)
Security clearance:
Ability to Commute:
- Washington, DC 20585 (Required)
Work Location: Hybrid remote in Washington, DC 20585
