The Senior Cloud Security Operations Manager leads security operations for federal cloud environments, focusing on AWS and Azure. The role oversees cloud monitoring, incident response, vulnerability management, and security posture using tools such as Splunk ES and Prisma Cloud. This position defines detection use cases, builds and maintains AWS logging and integrations, drives compliance with federal standards, and manages a small technical team to ensure secure, reliable cloud services.
Responsibilities
- Lead cloud security operations for AWS environments, including triage, investigation, containment, and recovery.
- Administer and optimize Splunk Enterprise Security, including data onboarding, CIM alignment, rules, dashboards, and reporting.
- Manage Prisma Cloud CSPM outcomes, policies, exceptions, and remediation workflows to improve security posture.
- Engineer and maintain AWS security logging and integrate services like Cloud
- Trail, VPC Flow Logs, and Guard
- Duty into monitoring tools.
- Define and execute AWS incident response playbooks and lead incident handling, evidence collection, and post-incident actions.
- Drive detection engineering mapped to MITRE ATT&CK and continuously improve detection fidelity and coverage.
- Ensure continuous monitoring and support compliance with federal security standards such as FISMA and NIST 800-53.
- Manage and mentor security analysts and engineers, setting performance expectations and overseeing delivery quality.
Required Skills
- Cloud security engineering (AWS, Azure)
- SIEM administration (Splunk ES)
- Cloud security posture management (Prisma Cloud or CSPM)
- Cloud incident response
- MITRE ATT&CK detection engineering
- AWS security services (Cloud
- Trail, Guard
- Duty, Security Hub, etc.)
- Identity and access management (IAM) in cloud
- Vulnerability management coordination
- Security compliance (FISMA, NIST 800-53)
- Security automation and scripting