> Markdown version of [/jobs/ext/3003998-cleared-noc-soc-lead](https://www.wearedevelopers.com/jobs/ext/3003998-cleared-noc-soc-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # cleared NOC/SOC Lead - **Company:** CareerCircle - **Location:** Newport News, VA, United States - **Experience:** Expert - **Salary:** $116,350.0 - $210,325.0 - **Contract:** Permanent contract - **Skills:** 3d Models, Computer-Aided Design, AutoCAD, Audit Trail, Configuration Management, Cyber Security, Information Systems, Geospatial Intelligence, Monitoring of Systems, Identity and Access Management, Zero Trust Network Access, SAP Implementation, Security Information and Event Management, Siemens NX, Software Vulnerability Management, Privacy Controls, Integrated Service Routers, Tanium Platform Expertise, Nessus, Cyber Warfare, Scap Compliance Checker, Devsecops, Plan of Action and Milestones, Vulnerability Analysis - **Published:** September 19, 2026 - **Apply:** https://www.careercircle.com/jobs/all/all/usa/va/hampton/42937605-3f0a-46f0-a84f-ddbdbc776a6a ## About the Role * Clearance: US Citizen with at least an active Top Secret clearance and the ability to obtain a SCI prior to your start date. * Education: Bachelor's Degree with 12+ years of experience or a Master's degree with 10+ years of experience. Additional experience may be considered in lieu of a degree. * Certifications: DoD 8570/8140 IAT Level III or IAM Level II certification. * Experience: 10+ years of combined IT/IS experience, including substantial hands-on RMF and ATO work and at least 3 years leading cybersecurity operations teams. * RMF & ATO Expertise: + Thorough working knowledge of DoDI 8510.01 (RMF for DoD Systems), NIST SP 800-37, and NIST SP 800-53 security and privacy controls. + Proven experience developing and maintaining ATO packages in eMASS, including System Security Plans (SSPs), control implementation statements, and artifacts. + Demonstrated ability to manage Plans of Action and Milestones (POA&Ms), risk acceptance documentation, and continuous monitoring (ConMon) strategies. + Experience supporting ATO assessments, reauthorizations, and Security Control Assessor (SCA) validation activities. * Operations Expertise: + Experience with enterprise monitoring and SIEM platforms and incident response workflows. + Hands-on familiarity with DoD compliance tooling, including ACAS/Nessus, STIG Viewer, SCAP Compliance Checker, and Evaluate-STIG. + Working knowledge of DoD incident handling and reporting requirements. * Leadership: Demonstrated ability to supervise multi-shift operations staff, manage escalations, and communicate risk clearly to technical and senior government audiences. Preferred Qualifications: * Clearance: US Citizen with an active TS/SCI * RMF Certification: ISC2 CGRC or equivalent governance, risk, and compliance credential. * CSSP Certification: DoD 8570/8140 CSSP Analyst or Incident Responder certification (e.g., CySA+, GCIH, GCIA). * Classified Authorization: Experience authorizing classified systems under ICD 503 (IC) or the Joint SAP Implementation Guide (JSIG). * Continuous ATO: Exposure to continuous ATO (cATO) initiatives, DevSecOps pipelines, or automated control inheritance. * Zero Trust: Familiarity with the DoD Zero Trust Strategy and mapping ZT capabilities to RMF controls. * Endpoint & Security Tools: Experience with Trellix/HBSS, Tanium, or comparable endpoint security and asset management platforms. * ITSM: Experience with ITIL-based service management and ticketing platforms. ## Description Nessus Tooling ICD 503 Equities Timelines DevSecOps Operations Leadership Automation Governance Market Data NIST 800-37 NIST 800-53 CSSP Analyst Security Tools Asset Management Operational Risk Cyber Operations Security Controls Incident Response Endpoint Security Automatic Control Service Management SAP Implementation Medical Monitoring Information Systems GIAC Certifications Top Secret Clearance Continuous Monitoring Vulnerability Scanning Configuration Management Vulnerability Management Risk Management Framework IAM Level II Certification IAT Level III Certification Assessment And Authorization Continuous Improvement Process GIAC Certified Incident Handler GIAC Certified Intrusion Analyst Host Based Security System (HBSS) CompTIA Cybersecurity Analyst (CySA+) Plan Of Action And Milestones (POA&M) Tanium (Endpoint Management Software) Information Technology Infrastructure Library Security Information And Event Management (SIEM) Enterprise Mission Assurance Support Service (eMASS) Information Assurance Vulnerability Management (IAVM) Top Secret-Sensitive Compartmented Information (TS/SCI Clearance), The Defense Sector at Leidos is seeking a cleared NOC/SOC Lead to direct combined network and security operations supporting Department of Defense (DoD) information systems, with primary emphasis on the Risk Management Framework (RMF) and the Authorization to Operate (ATO) lifecycle. This individual will lead operations staff across monitoring, incident response, and vulnerability management while ensuring daily operations produce the evidence, compliance posture, and continuous monitoring outputs required to obtain and sustain system authorizations. The NOC/SOC Lead will serve as the operational bridge between engineering teams, ISSMs/ISSOs, and the Authorizing Official (AO)., * Lead operational support for all RMF steps, from categorization and control selection through assessment, authorization, and continuous monitoring. * Coordinate with ISSMs/ISSOs to build, update, and maintain ATO packages in eMASS, ensuring artifacts reflect the current operational state of the system. * Own the POA&M process for operations-related findings: track remediation, validate closure evidence, and escalate overdue items. * Prepare operations teams for ATO assessments, reauthorizations, and cyber inspections (e.g., CCORI), and lead the remediation of resulting findings. * Assess the security impact of proposed changes and ensure Configuration Control Board (CCB) decisions are reflected in authorization documentation. Continuous Monitoring & Compliance * Execute the system ConMon strategy, ensuring scheduled vulnerability scans, STIG checks, and audit log reviews are completed and documented. * Oversee ACAS scanning cadence and vulnerability remediation timelines in accordance with IAVM, TASKORD, and OPORD directives. * Produce compliance metrics and risk posture reporting for government leadership and the AO. Operations Leadership * Direct day-to-day NOC and SOC operations, including network health monitoring, security event triage, and service restoration. * Lead incident response activities, coordinate with the CSSP, and ensure timely and accurate incident reporting. * Develop and maintain SOPs, runbooks, shift turnover procedures, and escalation matrices. * Supervise, schedule, and mentor NOC/SOC analysts and technicians; identify training needs and support staff certification compliance. Coordination & Governance * Serve as the primary operations liaison to ISSMs, ISSOs, SCAs, engineering teams, and government stakeholders. * Participate in CCB meetings and security reviews, representing operational risk and supportability considerations. * Drive continuous improvement of operational processes, tooling, and automation to reduce compliance burden and response times., AutoCAD Planning Visionary Innovation Siemens NX Mechanical Design 3D Modeling Software Computer-Aided Design Manufacturing Operations Engineering Design Process +0 VAS Associate CBRE Norfolk, VA*On-Site Sales Research Mentorship Real Estate Market Value +0 GEOINT Program Advisor Leidos Hampton, VA*On-Site Teamwork Equities Operations Innovation Market Data Communication Quality Control Ancient History Critical Thinking Emerging Technologies Geospatial Intelligence Integrated Service Routers Distributed Common Ground System (DCGS) +0 Login | JoinContact ## Related Videos - [WebAssembly Revolution: Elevating JavaScript's Reach and Performance](https://www.wearedevelopers.com/videos/1149-webassembly-revolution-elevating-javascript-s-reach-and-performance) - [TresJS a new declarative ThreeJS as Vue components](https://www.wearedevelopers.com/videos/543-tresjs-a-new-declarative-threejs-as-vue-components) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [Cross platform Augmented Reality development with React Native](https://www.wearedevelopers.com/videos/160-cross-platform-augmented-reality-development-with-react-native) - [Debugging Machine Learning Code](https://www.wearedevelopers.com/videos/71-debugging-machine-learning-code) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)