SOC Shift Lead – Cyber Defense Operations (TS/SCI Clearance Required)

Rapid Strategy is a premier cybersecurity and IT consulting firm supporting federal, defense, and commercial clients. We provide advanced cybersecurity operations, IT modernization, and security engineering services that enhance mission resilience and protect national infrastructure.

We are seeking an experienced SOC Shift Lead to lead cybersecurity operations during swing, weekend, and holiday shifts for a federal government client in Washington, D.C. This position is 100% onsite and requires an active TS/SCI clearance.

The SOC Shift Lead is responsible for leading a team of cybersecurity analysts and ensuring 24x7 monitoring, triage, and response to cyber incidents. This position requires strong leadership, operational discipline, and hands-on experience with enterprise SIEM, EDR, and threat detection technologies.

The successful candidate will oversee incident detection and response activities, manage shift handoffs, coordinate with mission stakeholders, and ensure compliance with operational SLAs and security policies.

• Serve as the lead cybersecurity authority during assigned swing/weekend/holiday shifts.

• Monitor, analyze, and respond to security events from SIEM and threat detection tools.

• Coordinate and lead incident triage, escalation, and containment activities.

• Supervise SOC analysts, assign tasks, and ensure SLA compliance.

• Maintain situational awareness across cyber threats, incidents, and alerts.

• Conduct shift briefings, document incidents, and ensure detailed handoff reporting.

• Support threat hunting, vulnerability analysis, and detection tuning.

• Integrate data from multiple sources (EDR, firewall, IDS/IPS, vulnerability scanners).

• Collaborate with Incident Response and Engineering teams for resolution and recovery.

• Ensure adherence to NIST, RMF, FISMA, and DISA STIG requirements.

• Active TS/SCI clearance (mandatory)

• Bachelor’s degree in Cybersecurity, IT, or related discipline (or equivalent experience)

• 5+ years of experience in a Security Operations Center or Cyber Defense environment

• 2+ years of experience in a lead or supervisory role

• Proficiency with:

  • SIEM platforms (Splunk, ArcSight, Sentinel, QRadar, Elastic)

  • EDR tools (CrowdStrike, SentinelOne, Tanium, Carbon Black)

  • Vulnerability tools (ACAS, Tenable/Nessus)

• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and incident response frameworks

• Strong analytical, communication, and decision-making skills

• DoD 8570 IAT Level II/III certification (e.g., Security+, CySA+, GCIH, or CISSP)

• Experience supporting DoD or Intelligence Community SOCs

• Familiarity with SOAR playbooks and threat intelligence platforms

• Understanding of cloud security and Zero Trust Architecture (ZTA)

• Proven ability to lead under pressure in mission-critical environments

• Swing shift: evening and weekend coverage (exact hours may vary)

• Includes rotating holiday assignments

• Shift differential pay for off-hours coverage