Security Operations Manager

Overview Security Operations Manager Tysons Corner, VA Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer’s core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level!  Astraeus Operations (AO) is an SBA-certified 8(a) Small Disadvantaged Business (SBD) subsidiary of the Chenega Corporation, an Alaska Native Corporation (ANC). We are a small business with large business capabilities due to our shared-services Program Management Office (PMO) structure. Through our ISO 9001:2015 certification, we can accomplish the full range of contract services including financial, human capital, recruiting, procurement, security, and technical resources to achieve contract mission requirements. As a result, our ‘small business – big capability’ dynamic benefits our clients through consistent communications and straight-lined workflows, ensuring our accountability to our clients for successful mission fulfillment. In plain terms, our clients gain a team that’s on the same page to achieve and support the client’s mission. We vigorously respond to clients’ requests without additional costs, delays, or inefficiencies that are often experienced with larger, more cumbersome organizations. AO is eligible for sole source, direct awards up to $100M for DOD and up to $25M for other federal agencies, without J&A. Astraeus is the easy button for a client wishing to take advantage of the rapid, agile, and flexible sole source procurement option. Combined with the shared PMO services, Astraeus offers highly competitive labor rates to fulfill day-to-day contract operations. The SecOps Manager serves as an on-floor subject matter expert supporting Google Public Sector’s (GPS) 24/7/365 Tier 1 security operations in sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across Google sovereign infrastructure and air-gapped offerings. The manager leads shift operations, coaches analysts, pre-screens technical escalations to Google SecOps engineering, and drives security playbook and alert-tuning improvements while ensuring high-confidence triage, timely responses, and continued partner ownership of incidents. Responsibilities Lead on-floor Tier 1 security operations and coach analysts in monitoring GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools, Splunk, ELK, designated SIEM systems, and EDR tools. Oversee initial GPS customer and incident-reporting support, including email and support portals. Ensure alerts are acknowledged within 5 minutes of creation and receive a First Meaningful Response (FMR) within 15 minutes for High/Critical alerts and 25 minutes for all others. Guide incident-detail collection, severity categorization, event enrichment, and correlation. Validate evidence and disposition justifications for high-confidence triage and ensure all true positives are escalated to the appropriate Google SecOps representative per procedures and runbooks. Ensure partner ownership of ServiceNow incidents, investigations, customer updates, follow-on actions, and required government incident-report drafts continues during Google technical consults. Transfer ownership only with explicit Google manager approval; coordinate incident response and required EDR tooling with Google SecOps. Pre-screen technical consults during core hours using analyst summaries of Observed Activity, Playbooks/Queries Run, IOCs, and Proposed Disposition. Review off-hours pre-screening by designated senior analysts the next business day. Ensure active High/Critical handoffs include Current Status, Analysis Completed, and Next Steps and are immediately accepted by the incoming shift without rejection. Drive playbook development, validation, and continuous improvement with engineering teams. Track noisy alerts and broken playbooks, coach analysts on appropriate responses, and partner on SIEM detection tuning. Provide hands-on-keyboard accreditation support to validate playbooks, runbooks, IT infrastructure, and Data Center operations. Coordinate operational coverage with the on-shift team to maintain at least two active personnel and at least one FTE in each occupied SecOps room, including holidays, PTO, training, and severe or inclement weather. Ensure SecOps calls are answered and routed, on-call guidance is sought as needed, and virtual communications receive responses within 15 minutes. Serve as live Queue Manager or ensure a designated senior on-shift analyst fills the role each shift. Monitor alert timers and intervene at least 5 minutes before response targets expire so no SLA breach goes unnoticed. Attend requested customer situational awareness calls and ensure noteworthy information and tasking are relayed through designated channels within 1 hour, using appropriate unclassified wording when required. Coordinate weekly activity reporting due Friday by 15:00 EDT, covering alert response SLA compliance, triage dispositions, playbooks validated/updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing. Provide operational inputs on hours incurred, upcoming-month support, and active issues/blockers for monthly financial status reports due by the following month’s 10th. Other duties as assigned. Qualifications 5+ years of experience in security operations (SOC) or incident response, including leading shift operations, pre-screening technical escalations, coaching security analysts, and partnering with engineering teams on SIEM detection