Cyber Workforce Development Lead
Washington, DC – onsite Monday-Thursday
ship required per government contract
Must be able to obtain Public Trust clearance

*** hands on Splunk experience is required for this position ***

The Cyber Workforce Development Lead is responsible for the strategic planning, assessment, and enhancement of the cybersecurity team’s capabilities. This role ensures that all contract staff meet federal qualification standards, remain proficient in the Government’s evolving toolset, and are prepared to defend against emerging cyber threats.

Primary Responsibilities:
Workforce Planning & Strategy: Develop and maintain the Cyber Workforce Development Plan. This includes mapping staff skills to the NICE Framework and identifying future staffing needs based on evolving technology.
Training & Curriculum Development: Create and update training programs for Defensive Cyber Operations (DCO). This involves tailoring training to address gaps identified after After Action Reviews (AARs) or major security incidents.
Tool Proficiency Management: Ensure 100% of the staff is trained on Government-provided tools (e.g., SIEM, EDR, SOAR). You must schedule and track training for any new tools introduced to the environment.
Compliance & Onboarding: Oversee the technical in-processing and out-processing of staff. Ensure all personnel complete mandatory federal training and maintain the necessary credentials for system access.
Quality Control & Mentorship: Participate in the quality control process for shift management. You will also lead the mentoring of visiting Court personnel to help them understand SOC operations.
Stakeholder Coordination: Meet weekly with Federal management to report on staffing risks, training progress, and workload metrics.

Job Deliverable
Internal Guidelines and SOPs
The Lead ensures the how-to of the SOC is documented and current.
•   Drafting & Updates: Create or update Standard Operating Procedures (SOPs) for all tools, analyst workflows, and team interactions.
•   Timeline: These must be submitted to Federal management for approval within 30 days of adopting a new tool or changing a workflow.
•   Quality Control: Ensuring these documents aren't just technical manuals, but Operational Guides that reflect the actual daily tasks of the DCO team.
Final Cyber Workforce Development Plan
This is the Lead's most important strategic document. It is a living document that must include:
•   Training Roadmap: A schedule of all planned and completed training for every contract staff member.
•   Tool Proficiency Matrix: Documentation showing that staff are proficient in the specific tools used in the SOC.
•   TTP Mastery: Evidence that the team understands the current Tactics, Techniques, and Procedures (TTPs) used by adversaries.
•   Gap Remediation: Specific training modules designed to fix vulnerabilities or performance issues identified by the COR.
•   AAR Integration: Mandatory updates to the plan following any After Action Review of a major incident to ensure mistakes aren't repeated.
Weekly Status Reports/Meetings
While the Program Manager may lead the call, the Workforce Development Lead provides the data for the following:
•   Staffing Risks: Identifying any minimum staffing concerns or risks to 24/7 coverage.
•   Workload Metrics: Reporting on the team's efficiency and any roadblocks (e.g., Team needs more training on X tool to improve speed).
•   Issue Resolution: Proposing specific options to the COR to resolve performance or personnel hurdles.

Required Skills & Knowledge (Per NICCS OG-WRL-003)
•   NICE Framework Alignment: Ability to standardize position descriptions and career paths using the National Initiative for Cybersecurity Education (NICE) standards.
•   Gap Analysis: Skill in conducting learning needs assessments to identify where the team is struggling (e.g., if the team is missing Threat Hunting skills, you build the plan to fix it).
•   Instructional Design: Knowledge of how to develop effective SOPs, training manuals, and Operational Guides that staff can actually follow during an incident.
•   Metric Development: Ability to establish Readiness Metrics to prove to the Government that the team is prepared for 24/7 operations.
Key Performance Indicators (KPIs)
•   Staff Readiness: Percentage of staff fully certified and trained on current SOC tools.
•   AAR Implementation: Speed at which training plans are updated following a major incident.
•   Retention & Growth: Tracked progress of junior analysts moving into mid/senior-level roles.

System One, and its subsidiaries, including Joulé, ALTA IT Services, and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.

#M1
#LI-VH1
#DI-VH1

Ref: #851-Rockville-S1

Cyber Workforce Development Lead (hybrid)

Similar Jobs