SOC Manager
No salary listed
Senior
Bachelor's
Washington, DC, USA
HybridHybrid role with on-site work in Washington, DC.
CybersecuritySecurity Operations & Incident Response
No H1B Sponsorship
US Top Secret Clearance Required
About the job
Requirements
- An active Public Trust clearance is required.
- A Bachelor of Science degree in Computer Science or Information Technology is required.
- At least 7 years of experience in an active incident responder position is required, including 2 years within the last 5 years providing technical direction to a security operations center supporting more than 5,000 endpoints.
- At least 2 years of experience implementing incident response in a federal environment in accordance with federal incident-handling guidelines, including NIST CSF and NIST SP 800-61, is required.
- At least 2 years of experience using Splunk security information and event management to correlate cybersecurity alerts is required.
- At least 3 years of experience auditing Linux and Windows operating systems to perform cybersecurity services is required.
- Strong technical writing skills are required to communicate complex analytical findings and produce clear, concise, well-structured reports, including executive-level reports.
- The role aligns to NICE work role PD-WRL-001, Defensive Cybersecurity.
- An active SANS GCIH or GCIA certification is required.
Responsibilities
- Provide operational leadership and management oversight for 24x7x365 security operations center operations supporting Judiciary cybersecurity activities.
- Manage cybersecurity triage, incident response, containment, remediation, recovery, and post-incident review activities.
- Ensure operational adherence to the Judiciary Security Operations Center Incident Response Plan, security operations center standard operating procedures, and AO-defined escalation procedures.
- Oversee alert triage using Splunk Enterprise Security, Microsoft Sentinel, ServiceNow, Jira, and other approved Government systems.
- Ensure timely acknowledgment, triage, escalation, and handling of cybersecurity alerts according to service-level agreement requirements and incident-prioritization timelines.
- Lead operational coordination during Priority 1 and Priority 2 cybersecurity incidents and ensure timely government notification and escalation.
- Oversee development and maintenance of cybersecurity triage work instructions, incident-handling standard operating procedures, response-action procedures, and operational documentation.
- Manage security operations center analysts, incident responders, and forensic personnel to ensure staffing coverage, operational readiness, and quality performance.
- Review and validate cybersecurity incident reports, post-incident reviews, forensic reports, malware-analysis reports, and operational-status reporting.
- Coordinate with AO leadership, federal staff, watch officers, branch chiefs, and stakeholders regarding cybersecurity incidents, operational risks, and emerging threats.
- Ensure accurate documentation of cybersecurity activities, artifacts, timelines, and communications within ServiceNow and other authorized systems.
- Manage operational metrics including Mean Time to Acceptance, Mean Time to Triage, containment timelines, remediation timelines, and quality-assurance metrics.
- Conduct weekly technical meetings and provide operational briefings, metrics, trends, risk assessments, and remediation recommendations.
- Develop and maintain Common Operational Picture awareness and cybersecurity operational reporting for AO stakeholders.
- Support continuous-improvement initiatives by identifying detection gaps, process inefficiencies, workflow improvements, and operational enhancements.
- Coordinate cybersecurity forensics and malware-analysis activities, including evidence preservation, malware analysis, root-cause analysis, and artifact review.
- Ensure operational compliance with NIST SP 800-53, NIST SP 800-61, the NIST Cybersecurity Framework 2.0, and ITIL v4 principles.
- Support transition-in and transition-out activities, including onboarding, operational readiness, training, and knowledge transfer.
- Provide executive-level and technical-level cybersecurity briefings, reports, and presentations.
- Support enterprise security-awareness reporting and development of operational key performance indicators.
About the company
cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It helps agencies design, implement, and manage security architectures, cross-domain data workflows, and geospatial solutions through consulting, implementation, and ongoing support. It differentiates itself with 18+ years of federal-focused experience and deep domain knowledge in government cybersecurity and geospatial work. Its goal is to help federal agencies protect operations, comply with regulations, and optimize IT and geospatial capabilities for secure, efficient government services.
Company Size
11-50
Company Stage
N/A
Total Funding
N/A
Headquarters
Largo, Florida
Founded
2006
Get referred to cFocus Software
See people who can refer or advise you
Simplify's Take
What believers are saying
- DHS won its geospatial protest on July 29, 2026, validating cFocus's award.
- GAO denied the NIH emergency call center protest, confirming competitive strength.
- CMMC Level 2 and renewed ISO certifications on July 11 and July 16, 2025 strengthen bids.
What critics are saying
- HUD OCIO POG 4 task order expires September 29, 2026, risking $3.7 million.
- DFC cyber BPA ends September 23, 2026, shrinking recurring revenue visibility.
- Dependence on federal recompetes invites displacement by larger integrators and cloud specialists.
What makes cFocus Software unique
- Microsoft Gold Certified Partner with FedRAMP automation and Azure Government focus.
- Exclusive ATO as a Service branding distinguishes cFocus in federal cloud compliance.
- Small-business SDB status helps win set-aside federal IT work.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Remote Work Options