IT Branch Manager - Security Operations #177

Target Hiring Range: $190,000-$195,000

Department: Chief Information Officer Posting Date Range: 10/22/2026-11/20/2026 Pay Grade Range: $156563-$204402

Work Hours: 8:30 a.m. to 5:30 p.m.

FLSA Status: Exempt

Work Location Status: Hybrid

Hybrid Schedule: 2-3 days per week onsite.

All remote or hybrid work arrangements must be performed from within the continental United States, subject to Sergeant at Arms approval.

The Senate Sergeant at Arms does not pay for relocation expenses.

This vacancy announcement closes at 11:59pm EST. Late applications will not be accepted.

Job Description

JOB OVERVIEW

The Target Hiring Range for this position is: $190,000-$195,000

At the SAA, we are committed to excellence in safeguarding our nation’s legislative processes. As part of our dedicated cybersecurity team, you’ll play a crucial role in strengthening our cybersecurity posture, ensuring the integrity and resilience of the systems and information pivotal to our democracy. Join us in our mission to blend people, processes, and technology into a cutting-edge, continuous risk-reduction framework that is not only flexible and innovative, but significantly impactful.

Role Overview

The Cybersecurity Branch Manager – Operations leads a team of 20–40 cybersecurity professionals spanning the Cyber Security Operations Center (CSOC), Incident Response, and Threat Hunt functions. Reporting to the Deputy CISO, this role carries direct accountability for 24/7 detection and monitoring coverage, incident response operations, and the maturity and direction of the organization’s threat hunt program. This is a practitioner-leader role. The ideal candidate brings hands-on technical depth earned in SOC or IR environments and has grown into a leader capable of setting strategy, developing talent, and driving operational excellence across multiple teams. You will partner closely with the Deputy CISO and peer leaders across the SAA to align security operations with the organization’s broader risk management mission — protecting the systems and information central to the U.S. legislative process. Candidates must be eligible to obtain and maintain a security clearance.

Key Responsibilities

• Team Leadership & Development: Directly manage and develop a team of 20–40 CSOC, Incident Response, and Threat Hunt professionals. Set performance expectations, foster a culture of continuous improvement, and build the bench strength needed to sustain operational excellence.
• Security Operations Oversight: Own 24/7 CSOC operations, ensuring detection coverage, alert triage, and escalation processes are effective, well documented, and continuously refined against an evolving threat landscape.
• Incident Response Management: Lead the organization’s response to significant security incidents — from initial detection through containment, eradication, recovery, and post-incident review. Ensure lessons learned drive measurable improvements to policy and process.
• Threat Hunt Program Direction: Define and drive the threat hunt program roadmap, ensuring hunt operations are hypothesis-driven, intelligence-informed, and integrated with detection engineering outcomes.
• Policy & SOP Ownership: Develop, maintain, and enforce security policies, standard operating procedures, and service level agreements that reflect the SAA’s risk posture and compliance obligations.
• Strategic Planning & Alignment: Partner with the Deputy CISO to align security operations priorities with organizational risk management goals, regulatory requirements, and the broader SAA mission.
• Vendor & Resource Management: Manage operational security vendors and tools, providing input into budget planning and ensuring the team is equipped with the capabilities needed to execute its mission effectively.
• Stakeholder Communication: Deliver clear, concise operational briefings and reports to senior leadership and, on occasion, external stakeholders. Translate complex technical findings into actionable information for non-technical audiences.
• Threat & Vulnerability Awareness: Maintain current awareness of the threat landscape, emerging attack techniques, and relevant vulnerabilities — ensuring operational priorities and detection coverage reflect real-world risk.
  
  

Key Accountabilities/Essential Job Duties

Sets technical performance standards for outsourced services, evaluates vendor contract compliance, and leads all phases of contract re-competitions, including requirements development and RFP management. Directs strategic planning and oversees branch operations, ensuring effective prioritization, resource allocation, personnel management, and project oversight. Develops and manages the branch budget, including forecasting, expenditure control, justification materials, and contributions to budget testimony; applies cost-benefit analysis to optimize service efficiency. Oversees all aspects of staff management, including recruitment, onboarding, training, development, motivation, and performance evaluation within the branch. Establishes and enforces branch and department policies, procedures, and operational standards. Prepares operational reports, approves procurement actions, and manages essential administrative functions. Other duties as assigned.

JOB SPECIFICATIONS

Required Education

Bachelor's Degree.

Other Duties/ Responsibilities

• May serve as Contracting Officer’s Representative (COR) for one or more contracts.
• Establishes policies and practices governing the operation, services, and staff of the branch.
• Serves as the Director in their absence.
• Leads or participates in user groups, task forces, and steering committee activities with other Senate or legislative branch organizations.
• Represents the SAA in meetings and activities with senior management of other Senate or legislative branch organizations.
  
  

Required Work Experience

• At least eight years of progressively responsible experience in information technology, information security, cybersecurity, or a related technical field, including at least six years of leadership experience within a cybersecurity environment.
  
  

Required Special Skills/ Knowledge

• Strategic leadership of complex cybersecurity and IT programs, including priority-setting, resource allocation, and risk evaluation.
• Proven ability to lead, manage, and develop technical, professional, and managerial staff.
• Advanced knowledge of cybersecurity, IT principles, frameworks, security controls, and emerging technologies.
• Strong understanding of public-sector procurement, contracting, budgeting, personnel management, and project management.
• Experience managing multimillion-dollar budgets, major contracts, vendors, and investment portfolios.
• Ability to analyze complex technical, operational, financial, and organizational issues and make sound decisions.
• Executive-level communication skills for advising leadership, building consensus, and engaging diverse stakeholders.
• Ability to establish and enforce cybersecurity policies, standards, and operational practices.
• Skilled in planning and overseeing multiple technical units and IT projects from conception to completion.
• Ability to contribute to and execute strategic IT and cybersecurity plans aligned with organizational goals.
• Commitment to ongoing professional development and staying current with IT and cybersecurity trends.
• Ability to obtain and maintain CISSP certification.
• As part of our hiring process, we may conduct a skills assessment to better understand an applicant’s proficiency in key areas relevant to the role.
  
  

Desired Qualifications

• Education: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a closely related field is preferred.
• Experience: A minimum of 8–10 years of experience in program or information technology management, with at least 8 years in a leadership or management capacity within a cybersecurity environment.
• Operational Leadership: Demonstrated experience leading a Security Operations Center (SOC), Incident Response team, or Threat Hunt function at a management level. Candidates must have direct experience managing teams of security professionals, not just serving as a senior individual contributor.
• Certifications: Active CISSP or CISM certification is preferred.
• Clearance Eligibility: Prior clearance history is a plus.
• Communication & Leadership Skills: Proven ability to communicate complex technical findings clearly to senior leadership and non-technical stakeholders.
• Strong analytical, critical thinking, and team development skills are essential.
  
  

Technical Skills

Skills and Abilities:

• Operating Systems: Deep working knowledge of the internal functionality of major operating systems — Windows, Linux, and macOS — with preference given to candidates who also have familiarity with less common environments such as Cisco IOS, Solaris, or mobile operating systems.
• Detection Engineering & Rule Development: Hands-on competence with major detection rule formats including Sigma, YARA, Snort, and Suricata. Candidates should be capable of authoring, reviewing, and tuning rules — not just consuming them.
• Network Forensics: Demonstrated ability to conduct in-depth packet capture and NetFlow analysis to identify attacks that have evaded host-based detection mechanisms.
• Host Forensics: Hands-on familiarity with major artifact locations across Windows, Linux, and macOS environments, and proficiency with leading host forensic toolsets.
• Malware Analysis: Ability to perform triage-level malware analysis during active incident response, including script de-obfuscation, basic binary analysis, and live process examination.
• Red Team Fundamentals: Working knowledge of offensive techniques sufficient to validate and tune detections, assess coverage gaps, and meaningfully engage with red team findings.
• Scripting & Automation: Proficiency in at least one common scripting language — PowerShell, Python, Bash, Ruby, or Perl — applied to operational tasks such as log parsing, detection automation, or tool development.
• Intelligence Analysis: Ability to evaluate, synthesize, and communicate large volumes of fragmented or contradictory data into clear, actionable intelligence products that drive operational decisions.
  
  

Leadership & Management Skills

• Team Development: Demonstrated ability to recruit, mentor, and retain high-performing cybersecurity professionals. Experience building team capability through structured development plans, training, and hands-on coaching.
• Operational Management: Proven ability to manage shift-based or on-call operations at scale, including workload prioritization, escalation management, and sustaining team performance during high-tempo incidents.
• Cross-functional Collaboration: Ability to work effectively with peer leaders, IT teams, legal, compliance, and senior leadership to align security operations with broader organizational priorities.
• Executive Communication: Skill in translating highly technical investigation findings and operational metrics into clear, concise briefings and written reports for senior and non-technical audiences.
• Documentation & Knowledge Management: Ability to capture the results of complex, long-running investigations in a manner that is accurate, readable, and structured to drive future operations and institutional knowledge.
  
  

Working Conditions

• Work is performed in an office environment.
• Work requires occasional walking, standing, bending, and safely carrying items weighing less than 50 pounds, such as laptops, desktops, servers, and routers.
• Work requires extended periods of computer use.
• To meet the needs of the U.S. Senate, individuals in this position may be required to be on call or report onsite on a rotational basis within 24 hours.
• Occasionally, late-night and weekend work is required.
• Essential Services are functions and activities that are critical to the continuous operation, security, and support of the United States Senate. These services must remain operational without interruption to ensure the Senate can conduct official business. Positions supporting essential services require employees to be available and prepared to work, including during inclement weather, holidays, weekends, late nights, and overnight hours. Due to the nature of Senate operations, essential services, including network operations and infrastructure, cannot be suspended while the Senate is in session, and maintenance activities may be required outside of normal business hours.
• Excepted Services refer to functions and activities that are authorized to continue during a lapse of appropriations because they are necessary to the performance of the Senate’s constitutional functions, address emergency circumstances that imminently threaten the safety of human life or the protection of property, or directly support essential services of the United States Senate. Employees in excepted positions are generally required to work and remain operational during a lapse of appropriations to ensure continuity of critical Senate functions. These positions may involve working non-standard schedules, including nights, weekends, holidays, and extended hours, to maintain uninterrupted service and operational readiness.
  
  

Security Clearance

• This position requires that the applicant obtain and maintain a Top Secret U.S. Government security clearance.
• Applicants must be U.S. citizens in order for the SAA to submit your application for a security clearance.
  
  

CONDITIONS OF EMPLOYMENT

To be employed by a Senate employing office in a paid position in the continental United States an individual must:

• Be a U.S. citizen;
• Be lawfully admitted for permanent residence and seeking citizenship as outlined in 8 U.S.C.
• 1324b(a)(3)(B);
• Be (i) admitted as a refugee under 8 U.S.C.
• 1157 or granted asylum under 8 U.S.C.
• 1158 and (ii) have filed a declaration of intention to become a lawful permanent resident and then a citizen when eligible; or
• Owe allegiance to the U.S. (i.e., qualify as a non-citizen U.S. national under federal law).
  
  

Employment is contingent on background / security investigation results.

Benefits At-a-glance

The SAA provides a highly competitive benefits package for all SAA staff. Our benefits extend beyond health care coverage to help provide employees with student loan reimbursement, professional development, transportation subsidy, TSP/retirement savings, access to our Employee Assistance Program, and more! For more information regarding SAA’s benefits, please visit https://sen.gov/OPPW .

ACCOMMODATIONS

As an Equal Opportunity Employer, the SAA is committed to providing reasonable accommodations to applicants with disabilities. If you are interested in applying for employment with SAA and need special assistance or an accommodation to complete the application process, please submit your request to [email protected] with “Accommodation” in the subject line.

VOLUNTARY SELF-IDENTIFICATION FOR VETERANS' PREFERENCE

If you are identifying as veterans' preference eligible under the VEOA, please use this link to complete your application for Veterans' Preference AFTER you apply for this position. The link will also be available on the "Thank You" page after you have submitted your job application.

Candidates only need to apply one time for veterans’ preference to be considered for all future veterans’ preference positions within the Senate Sergeant at Arms.

• All supporting documents must ONLY be provided within the Veterans’ Preference Application and within the stated deadline of the job announcement.
• Late applications for veterans’ preference will not be considered.
• Documentation to obtain veterans’ preference will not be considered if attached to the job application.
• If you need to revise or resubmit your Application for Veterans' Preference/documents, please withdraw your previous Application for Veterans' Preference and resubmit. If you require assistance, please email [email protected] .
• To view additional information regarding the VEOA, please click here .
  
  

An applicant who declines to self-identify as a disabled veteran and/or to provide information and documentation regarding his/her disabled veteran’s status will not be subjected to an adverse employment action, but the individual may be ruled ineligible for veterans’ preference.