Washington, DC

Salary
Posted
Jul 14, 2026
Location
Washington, DC
Last confirmed open
Jul 21, 2026

What this job asks for AI summary

A hybrid, Washington DC-based role supporting a federal courts program, focused on leading cybersecurity shift operations. Day-to-day work centers on intrusion detection, incident response using EDR tools, and correlating alerts through Splunk SIEM. The position suits an experienced security analyst with Linux and Windows auditing background and an active SANS GCIH or GCIA certification.

Mid level · 3+ years · Washington-Arlington-Alexandria, DC-VA-MD-WV · Bachelor's required · Confidential clearance

Must have (7)
intrusion detection · 3+ yrsSplunk · 2+ yrsEDR · 2+ yrsLinux · 3+ yrsWindows · 3+ yrsGCIH or Gciaincident response

“or” means any one of them counts — you don't need all of them.

We read this from the posting text with AI. Skim the description below before ruling yourself out.

How this req sits in the market our data

What won't set you apart
Linux65%incident response62%Splunk45%EDR40%

Most people in this occupation already list these. Still required — just not what gets you shortlisted.

What the occupation pays Median $152,225 (middle half $125,286–$177,673).

Estimated from BLS employment for this occupation and area, per-skill prevalence across our listing corpus, and published wage benchmarks — as of Jul 28, 2026. It is a model, not a headcount.

Why we read it this way (5)

The posting requires a 'Public Trust' clearance, which is a federal suitability determination rather than a classified national security clearance. The closest schema value is 'Confidential'; however, Public Trust is technically a separate category. Hiring managers should note this is a federal background investigation requirement, not a DoD-style clearance.

The GCIH and GCIA certifications are listed as an 'or' requirement — holding either one satisfies the gate. GCIH is captured as the primary with GCIA as an alternative.

The title 'Shift Lead' implies some supervisory or coordination responsibility, but the qualifications are purely technical with no people-management language; the role is classified as Mid-level based on the 3-year experience gate and the scope described.

No compensation information is provided in the posting.

Requires a Confidential clearance — the cleared population is a small fraction of this occupation, so the real candidate pool is materially smaller than the estimate below, which does not model clearance.

Read the full posting

The employer publishes the full description on their own site — read it there ↗. Or sign in to read it here — it's free, and it also lets you track this application.

Apply

Apply on employer site ↗