NCO (National Cybersecurity Operations) Technical Lead at Och GmbH in Remote • Air Traffic Control System Command Center (ATCSCC) Washington, DC OR Leesburg, VA

Job description

• OCH Technologies is seeking an NCO Technical Lead responsible for leading the day-to-day operational cybersecurity and threat intelligence functions supporting the FAA's National Cybersecurity Operations mission. The lead will run the operational side: monitor threat intelligence feeds, coordinate incident response, analyze emerging threats against NAS infrastructure, and provide technical guidance to the broader cybersecurity team.
• This position supports a proposal effort and is contingent upon award, customer approval, and successful onboarding requirements.

Responsibilities

• Provide day-to-day technical oversight, coordination, and guidance to contractor personnel performing operational cybersecurity and threat intelligence functions.
• Lead all activities supporting the National Cybersecurity Operations (NCO) mission including threat intelligence collection and analysis, threat hunting, and incident response coordination.
• Monitor and analyze cyber threat intelligence relevant to FAA and NAS systems. Produce actionable intelligence products that inform assessment priorities and defensive posture decisions.
• Coordinate incident response activities when potential security events are identified. Ensure response actions follow established procedures and are documented.
• Attend all Program Management Reviews with the Program Manager and report on NCO operational support activities, threat intelligence findings, deliverables, and technical issues.
• Maintain awareness of emerging cyber threats targeting critical infrastructure, aviation systems, and government networks. Brief FAA leadership on threat trends and recommended defensive actions.
• Collaborate with the Security Assessment Lead and Penetration Testing Lead to ensure assessment and testing priorities reflect the current threat landscape.
• Develop and maintain standard operating procedures for NCO functions including escalation criteria, reporting templates, and coordination protocols.
• Manage and oversee contractor staff performing NCO functions. Ensure personnel maintain required qualifications and training.
• Responsibilities may evolve over time to support team and organizational goals but will remain consistent with the overall scope of the role.

Requirements

• Education
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics from an accredited institution
• Experience
• At least fifteen (15)+ years of cybersecurity experience with at least 5 years of management and supervisory responsibility over operational cybersecurity, threat intelligence teams, or SOC/CIRT functions. At least 2 years of relevant experience must be recent (performed within the last 3 years).
• Demonstrated experience leading incident response and threat intelligence operations in a federal or critical infrastructure environment.
• Strong understanding of cyber threat intelligence frameworks (MITRE ATT&CK, Diamond Model, Cyber Kill Chain) and experience producing actionable intelligence products.
• Experience with SIEM platforms, threat intelligence platforms, and endpoint detection and response (EDR) tools.
• Knowledge of network defense monitoring, log analysis, and anomaly detection in complex, multi-segment network environments.
• Candidate must have the ability to obtain and maintain a Public Trust
• Active Secret clearance preferred
• Certifications
• Security certification such as CISSP, CISM, or CASP required
• GCIH (GIAC Certified Incident Handler) or GCTI (GIAC Cyber Threat Intelligence) strongly preferred
• GCFA, GNFA, or GCIA preferred for forensics/network analysis depth
• CND, CNDA, GDAT, GDSA, GCED, GCFA are directly relevant
• Understanding of federal cybersecurity policy (FISMA, NIST CSF, CDM program) and how operational cybersecurity functions support broader agency security objectives.
• Strong written and verbal communication skills. Ability to brief senior leadership on threat landscape and operational status.
• Prior experience supporting FAA, DoD, or other critical infrastructure cybersecurity operations.
• Experience with aviation-specific cyber threats or operational technology (OT/ICS) threat analysis.
• Familiarity with FAA Security Operations Center (SOC) operations.
• Experience coordinating with federal threat intelligence sharing organizations (US-CERT, CISA, sector ISACs).
• Modern threat intelligence platforms (MISP, OpenCTI) for structured threat data management and sharing.
• SOAR platforms (Cortex XSOAR, Splunk SOAR, Tines) for automated incident response workflows and playbook execution.
• EDR/XDR tools (CrowdStrike Falcon, SentinelOne, Carbon Black) for endpoint-level detection and response in operational environments.
• AI/ML-based anomaly detection and threat hunting tools for identifying novel attack patterns across complex, multi-segment network environments.
• Attack surface management platforms for continuous external exposure monitoring of NAS-connected assets.

Skills

Preferred

• Attack surface management platforms

Benefits

• Step into a role at OCH where your contributions make a tangible impact. Join a team that values creativity and initiative, offering a platform to transform the landscape of government IT services. Here, your work is not just a career—it's a mission. Embrace the opportunity to grow, innovate, and excel alongside industry leaders who are as passionate about technology as they are about making a difference. Plus, we offer a comprehensive benefits package designed to support your wellbeing and work-life balance, including:
• Paid time off and Holidays
• Medical, Dental, and Vision Insurance
• Paid Parental Leave
• Short-term disability, long-term disability, and life insurance - Employer Paid!
• 401(k)
• Additional Voluntary Life Insurance
• Tuition Reimbursement
• & More!