Job description

SAIC is seeking a dedicated Cybersecurity Operations Supervisor to support our 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. This position combines hands-on cybersecurity operations with technical leadership, personnel management, and operational oversight. For the right candidate, this position may be remote anywhere in the US. The supervisor will be assigned to 3rd shift, with responsibility for overseeing personnel across both weekly schedules (Sunday – Wednesday and Wednesday – Saturday). • Third shift: 10:00 PM – 8:00 AM EST The Supervisor is responsible for supporting security investigations, maintaining team performance, developing analysts, and driving continuous improvement across ESOC operations. Role Overview: The Cybersecurity Operations Supervisor serves as a hands-on technical and operational leader within the Detection & Response team. This position conducts security investigations, manages assigned security incidents, and provides technical guidance to analysts while overseeing daily cybersecurity operations. The Supervisor is responsible for managing and developing assigned personnel, ensuring the quality and timeliness of security investigations, maintaining operational readiness, and driving accountability for team performance. The role also supports continuous improvement of SOC processes, procedures, and operational capabilities through collaboration with internal cybersecurity teams and stakeholders. Job Duties: • Supervise daily D&R operations, ensuring effective security monitoring, incident triage, investigation and escalation in accordance with established procedures. • Independently investigate security alerts and incidents using SIEM, EDR, and other security monitoring tools to analyze suspicious activity, determine potential impact, and support appropriate response actions. • Provide technical guidance and investigative support to cybersecurity analysts, assisting with complex investigations, troubleshooting, and incident escalation. • Manage assigned personnel, including performance evaluations, coaching, professional development, attendance, and accountability for individual and team performance. • Oversee operational workloads, investigation prioritization, task assignments, and staffing coverage to maintain effective 24/7/365 security operations. • Ensure the accuracy, completeness, and timeliness of incident investigations, case documentation, and escalation activities through routine quality assurance and performance reviews. • Monitor and assess operational performance metrics, identify performance gaps, and implement corrective improvements within established authority. • Lead the onboarding, training, and development of cybersecurity analyst through technical knowledge sharing, cross-training, and constructive feedback. • Identify opportunities to improve detection and response workflows, operational procedures, and team effectiveness, recommending and implementing improvements through established approval processes. Required Education and Experience: • Bachelor’s degree and 5+ years of experience. An additional 4+ years of experience may be considered in lieu of a degree. • Must be a US Citizen. • Must have a minimum of 5 years of hands-on experience in cybersecurity operations. • Must possess at least two of the following certifications: CompTIA Security+, CySA+, GSEC, GCIH, CEH or other related certifications. • Must obtain one of the following certifications within the first 8 months of start date: CISSP, CASP, CISM, GSLC, or GSOM. • Demonstrated leadership experience in a cybersecurity operations environment, including coordinating technical workloads, providing guidance and feedback, supporting analyst development, evaluating performance, and addressing operational or performance-related issues. • Experience assessing security incident severity, determining appropriate escalation paths, and coordinating response activities with relevant stakeholders. • Advanced experience with security monitoring and incident response technologies, including SIEM, EDR, cloud security platforms, and network analysis tools. • Working knowledge of Windows, Linux, network security and cloud environments (AWS and Azure), including the ability to analyst relevant security telemetry. • Understanding of common cyber threats, attacker techniques, and incident response processes. • Strong communication, organizational, and problem-solving skills, with the ability to provide technical guidance, deliver constructive feedback, and effectively lead personnel in a remote environment. Preferred Qualifications: • Previous experience in a formal supervisory or personnel-management role. • Experience developing, implementing, or improving SOC standard operating procedures (SOPs), incident response playbooks, and operational workflows. • Experience supporting security operations in large, enterprise or government contracting environments, including geographically distributed or remote teams.

Requirements

Must-haves

The supervisor will be assigned to 3rd shift, with responsibility for overseeing personnel across both weekly schedules (Sunday – Wednesday and Wednesday – Saturday).
Third shift: 10:00 PM – 8:00 AM EST
The Supervisor is responsible for supporting security investigations, maintaining team performance, developing analysts, and driving continuous improvement across ESOC operations.
Supervise daily D&R operations, ensuring effective security monitoring, incident triage, investigation and escalation in accordance with established procedures.
Independently investigate security alerts and incidents using SIEM, EDR, and other security monitoring tools to analyze suspicious activity, determine potential impact, and support appropriate response actions.
Provide technical guidance and investigative support to cybersecurity analysts, assisting with complex investigations, troubleshooting, and incident escalation.
Manage assigned personnel, including performance evaluations, coaching, professional development, attendance, and accountability for individual and team performance.
Oversee operational workloads, investigation prioritization, task assignments, and staffing coverage to maintain effective 24/7/365 security operations.
Ensure the accuracy, completeness, and timeliness of incident investigations, case documentation, and escalation activities through routine quality assurance and performance reviews.
Monitor and assess operational performance metrics, identify performance gaps, and implement corrective improvements within established authority.
Lead the onboarding, training, and development of cybersecurity analyst through technical knowledge sharing, cross-training, and constructive feedback.
Identify opportunities to improve detection and response workflows, operational procedures, and team effectiveness, recommending and implementing improvements through established approval processes.
Bachelor’s degree and 5+ years of experience. An additional 4+ years of experience may be considered in lieu of a degree.
Must be a US Citizen.
Must have a minimum of 5 years of hands-on experience in cybersecurity operations.
Must possess at least two of the following certifications: CompTIA Security+, CySA+, GSEC, GCIH, CEH or other related certifications.
Must obtain one of the following certifications within the first 8 months of start date: CISSP, CASP, CISM, GSLC, or GSOM.
Experience assessing security incident severity, determining appropriate escalation paths, and coordinating response activities with relevant stakeholders.
Advanced experience with security monitoring and incident response technologies, including SIEM, EDR, cloud security platforms, and network analysis tools.
Working knowledge of Windows, Linux, network security and cloud environments (AWS and Azure), including the ability to analyst relevant security telemetry.
Understanding of common cyber threats, attacker techniques, and incident response processes.

Nice-to-haves

Previous experience in a formal supervisory or personnel-management role.
Experience developing, implementing, or improving SOC standard operating procedures (SOPs), incident response playbooks, and operational workflows.
Experience supporting security operations in large, enterprise or government contracting environments, including geographically distributed or remote teams.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsazure

Platform: oracle-cloud
Effort: medium

Benefits

Benefits detected in the listing.

Professional Development