> Markdown version of [/jobs/ext/4607520-cybersecurity-cloud-ops-threat-and-incident-response-lead](https://www.wearedevelopers.com/jobs/ext/4607520-cybersecurity-cloud-ops-threat-and-incident-response-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cybersecurity Cloud Ops Threat and Incident Response Lead

- **Company:** Booz Allen Hamilton Inc.
- **Location:** McLean, VA, United States
- **Experience:** Expert
- **Salary:** $86,800 - $198,000
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Artificial Intelligence, Amazon Web Services, Cloud Computing, Cloud Computing Security, CompTIA Security+, Cyber Security, Intrusion Detection and Prevention, Security Information and Event Management, Retrieval-Augmented Generation, Large Language Models, Mttr, Agentic-AI, SC Clearance, Kubernetes, Information Technology, Splunk
- **Published:** November 6, 2026
- **Apply:** https://jobs.localjobnetwork.com/apply/add/88801983/1

## About the Role

* 3+ years of experience operating cloud security services in production, including AWS Security Hub, GuardDuty, Inspector, and CloudTrail
 * 3+ years of experience with a SIEM such as Splunk, including detection tuning and alert triage
 * Experience executing incident response runbooks and leading incident calls
 * Experience automating detection, triage, or response with scripting or AI-enabled tooling
 * Knowledge of NIST SP 800-53 Rev. 5, NIST SP 800-61, FedRAMP High, and DoD Cloud Computing SRG requirements
 * Ability to work across cyber, platform, and governance teams in fast-moving mission environments
 * Secret clearance
 * Bachelor's degree in a Cybersecurity, Computer Science, or Engineering field and 5+ years of experience in security operations, incident response, or threat detection, or 9+ years of experience in security operations, incident response, or threat detection in lieu of a degree

Nice If You Have:

 * Experience with AWS GovCloud or other IL4 or IL5 environments
 * Experience with Kubernetes (EKS) and container security monitoring
 * Experience with Tenable (ACAS), JFrog Xray, Trellix ePO, or Amazon Security Lake
 * Experience with agentic AI systems or LLM-enabled automation, including security monitoring of agent activity
 * Experience operating within structured SLAs, uptime requirements, and incident response MTTR and MTTA targets
 * Experience operating within structured SLAs, mission uptime requirements, and incident response MTTR/MTTA targets
 * Experience with Tenable, ACAS, JFrog Xray, Trellix ePO, or Amazon Security Lake
 * Experience with agentic AI systems, LLMenabled automation, or RAG/AI Factory platforms, including security monitoring of agent activity
 * Knowledge of pre-authorized automation and autonomy-level models for security operations
 * GCIH, GCIA, CISSP, Security+, or AWS Certified Security - Specialty certification