Cybersecurity Operations Lead / SOC Lead

Prometheus Digital, LLC supports federal cybersecurity missions with a team built for continuous monitoring, rapid response, and clear operational reporting. This hybrid role in Washington, DC focuses on strengthening real-time security operations and maintaining cybersecurity situational awareness across a federal IT environment.

Compensation: USD 97,500 - 118,000 per year. Experience: minimum 8 years in cybersecurity operations, incident response, or SOC environments.

Responsibilities

• Lead security operations including real-time monitoring, triage, and incident response within established SLAs.
• Manage SIEM operations using Microsoft Sentinel, with oversight of Microsoft Defender and security event logging.
• Conduct vulnerability scanning with Qualys, perform analysis, track remediation progress, and produce threat-focused reporting.
• Maintain continuous cybersecurity situational awareness and integrate CDM feeds to support ongoing visibility.
• Support federal security efforts including insider threat programs, privileged access controls, and FISMA reporting.

Requirements

• U.S. Citizenship is strictly required.
• Active Security Clearance: Secret (Required).
• Minimum 8 years of experience in cybersecurity operations, incident response, or SOC environments.
• Minimum 5 years supporting federal cybersecurity programs.
• Certification: CISSP (or recognized equivalent).
• Strong expertise with SIEM platforms, log analysis, vulnerability management, and federal compliance including FISMA, FedRAMP, and Zero Trust.

Preferred Qualifications & Experience

• Experience supporting DHS Continuous Diagnostics and Mitigation (CDM) DEFEND F dashboard integrations.
• Microsoft Certified: Security Operations Analyst Associate (SC-200) or CISM.
• Experience establishing incident response containment metrics under strict SLAs (for example, triage within 15 minutes and containment within 4 hours).
• Advanced knowledge of Microsoft Defender for Cloud Apps and Persistent Access Capability (PAC) feeds.
• Ability and willingness to step into cross-functional IT and cybersecurity responsibilities as operational needs arise, including cross-training and sharing operational coverage to maintain continuous mission support.

Tools & Technologies

• Microsoft Sentinel
• Microsoft Defender
• Qualys
• CDM feeds
• DHS Continuous Diagnostics and Mitigation (CDM) DEFEND F dashboard integrations
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Certified Information Security Manager (CISM)
• Microsoft Defender for Cloud Apps
• Persistent Access Capability (PAC) feeds

Work Location: Hybrid remote in Washington, DC 20004.