Location: Washington, DC
Work Arrangement: On-site up to four days per week
Clearance Requirement: Active Public Trust required; eligible to obtain a Secret clearance
Citizenship: U.S. Citizenship required

Position Overview

We are seeking a Product Champion with a strong background in cybersecurity operations, data analytics, Defensive Cyber Operations (DCO), and network security. The successful candidate will support and train cyber operational teams in the use of intelligence, data analytics, and coordination applications.

This position combines cyber threat hunting, data analysis, customer engagement, and technical training. The Product Champion will help identify emerging threats, analyze complex datasets, communicate findings, and translate operational requirements into actionable capabilities that improve cyber defense operations.

Key Responsibilities

• Support and promote the use of cyber intelligence, threat awareness, and operational coordination applications.
• Conduct cyber threat hunting activities across designated big data platforms.
• Analyze threat activity, identify patterns, and communicate findings through presentations and interactive sessions.
• Assist customers with threat hunting operations and analytical requests.
• Work directly with customers to identify operational requirements, capability gaps, and opportunities for improvement.
• Provide recommendations on data enrichment, platform functionality, and overall user experience.
• Perform quality assurance reviews of data maintained within operational platforms.
• Evaluate new and existing data feeds to determine relevance, quality, and usability.
• Develop and support data queries, dashboards, visualizations, and analytical products.
• Apply statistical analysis and modeling techniques to identify trends and uncover patterns in complex datasets.
• Translate analytical findings into clear, customer-facing visualizations and reports.
• Provide real-time customer support during normal business hours.
• Maintain awareness of emerging cyber threats and communicate relevant findings to impacted stakeholders.
• Develop and maintain documentation for data feeds, analytical products, and deliverables.
• Support demonstrations, customer briefings, and technical training sessions.
• Perform additional duties as assigned.

Required Qualifications

• Active Public Trust clearance or the ability to obtain and maintain the required U.S. Government clearance.
• U.S. Citizenship required.
• Five or more years of experience in cybersecurity operations or a related technical field with a bachelor's degree in Information Technology, Cybersecurity, or a related discipline; alternatively:
  
  • Three or more years of relevant experience with a related master's degree; or
  • Nine or more years of relevant experience with a high school diploma or equivalent.
• Experience supporting Department of Defense customers; experience supporting U.S. Cyber Command, DISA, DCDC, or Service Cyber Components is highly desirable.
• Ability to present technical analysis and findings to stakeholders with varying levels of technical knowledge.
• Proficiency with query languages such as SQL and Kusto Query Language (KQL).
• Experience with Python; familiarity with Jupyter notebooks is a plus.
• Experience developing dashboards and visualizations using tools such as Power BI or Superset.
• Familiarity with cloud environments, including Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).
• Knowledge of cyber threat hunting methodologies and techniques.
• Experience with Security Information and Event Management (SIEM) tools such as Splunk, QRadar, or ELK.
• Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms such as Sentinel, Cortex, or X-SOAR.
• Experience developing or deploying threat detection signatures.
• Experience collecting and analyzing data from cyber defense resources, including vulnerability databases and open-source intelligence.
• Ability to identify and categorize vulnerabilities and associated attack techniques.
• Ability to interpret detection signatures and formats such as Snort, Sigma, YARA, and YAML.
• Knowledge of network traffic analysis tools and methods, including TCPDump, Wireshark, and Zeek.
• Familiarity with the MITRE ATT&CK framework, cyber attack lifecycle, and incident response methodologies.
• Understanding of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).
• Strong communication, presentation, organizational, and analytical skills.
• Ability to work independently and collaboratively in a customer-facing environment.
• Ability to support training and presentations both in person and virtually.
• Ability to work on-site in Washington, DC up to four days per week, with occasional travel to a secondary office location.

Preferred Qualifications

• Active Secret security clearance.
• Industry-recognized cybersecurity certifications such as Security+, CySA+, GCIH, GNFA, GCFA, or Data+.
• Previous experience supporting a Department of Defense Security Operations Center (SOC).
• Familiarity with big data platforms and data lake architectures.
• Experience supporting cyber defense, threat intelligence, or operational analytics environments.

Work Environment

This is a customer-facing position requiring regular on-site support in Washington, DC, up to four days per week. The role may require occasional travel to another company office location and flexibility to support customer requirements, briefings, and training events.

Benefits Offered

• Medical, dental, and vision insurance: 100% company-paid premiums.
• Short-term disability, long-term disability, and life insurance: Fully company paid.
• 401(k): Automatic 10% company contribution; no matching required.
• Paid time off: Four weeks annually.
• Paid holidays: Eleven per year.
• Birthday leave: Your birthday off with pay.
• Referral bonuses: Upfront and annually recurring bonuses.
• Open-source bonuses: Rewards for contributing to our GitHub projects.
• Professional development: Paid training, certifications, and enrichment opportunities.

About Phoenix Operations Group

Phoenix Operations Group delivers advanced engineering services that protect and strengthen our nation’s cyber resources. As a small company, we invest in innovation and employee development to solve challenging customer problems. Our capabilities span batch and streaming Big Data analytics, cloud infrastructure, multi-INT visualization, and enterprise architecture. We support All-Source, Financial, and CND operational missions and serve as Product Owners for our open-source research initiatives.

Learn more at www.phoenix-opsgroup.com.

Equal Employment Opportunity

Employment decisions at Phoenix Operations Group are based on qualifications, merit, and business needs. We provide equal employment opportunities without discrimination based on race, religion, color, sex, gender, gender identity, sexual orientation, age, non-disqualifying physical or mental disability, national origin, veteran status, or any other legally protected basis.