SOC Manager

Title: SOC Manager

Location: Onsite – Washington, DC (telework at client discretion)

Terms: Full-time

Salary: $160K - $205K

Clearance: Public Trust

Travel: Minimal – occasional CONUS travel (approximately one week per year)

Position Description

We are seeking an experienced SOC Manager to lead and oversee a team of security analysts within a federal Security Operations Center (SOC) that operates 24x7x365 across on-premises and cloud environments. The SOC Manager is responsible for continuously monitoring and responding to cyber threats by detecting, analyzing, and mitigating security incidents, developing security policies and procedures, and ensuring compliance with security standards. This role leads the incident response process, manages the contractor SOC staff, and reports to the client’s SOC lead.

The successful candidate will:

• Lead effective, around-the-clock SOC operations across on-premises and cloud environments.
• Drive the incident response process from detection through closure.
• Communicate SOC performance, incidents, and trends clearly to senior management.
• Mature SOC processes, playbooks, and performance measurement.

Responsibilities:

• Manage the contractor SOC staff, reporting to the client’s SOC lead and assigning and deploying staff to achieve SOC objectives identified by the client.
• Lead the incident response process, including coordinating investigations, assigning tasks to analysts, and escalating critical incidents to relevant stakeholders.
• Direct shift managers who oversee staff activity on each shift to provide 24x7x365 management coverage, including escalation contacts, and delegate management authority during absences.
• Develop the SOC Communications Plan describing how the SOC Manager communicates with the client SOC lead, client leadership, and SOC staff.
• Create and maintain SOC process documentation, incident and event playbooks, and Standard Operating Procedures for all SOC processes.
• Train SOC staff in the execution of operating procedures and collaborate with client staff on these procedures.
• Develop and implement a quality management program to track SOC performance and assess changes in performance over time.
• Assess and manage SOC resource needs to maintain optimal performance.
• Use Security Information and Event Management (SIEM) tools to aggregate and analyze security logs for threat detection.
• Oversee real-time alert monitoring and triage, incident report intake and coordination, incident analysis, forensic and malware analysis, and containment, eradication, and recovery activities.
• Provide oversight and guidance for all cyber incidents, and ensure incidents are closed only after all remediation and reporting activities are complete.
• Coordinate with external organizations, including CISA and partner SOCs, under the direction of the client lead.
• Coordinate fly-away incident response at remote locations when directed, with the team able to deploy within 24 hours.
• Support the SOC Performance and Investment Metrics Program, and generate reports on security incidents and trends, communicating key findings to senior management.

Required Skills and Experience

• Bachelor’s degree in Computer Science or an IT-related discipline and Ten (10) years of experience running a SOC, with at least five (5) years of experience running a combined on-premises/cloud SOC.
• Ten (10) years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints, with duties that include all five functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover).
• CISSP or equivalent certification. (Equivalent certification covers a similar level of information security domains or depth of knowledge and/or experience.)
• Demonstrated leadership and team management abilities to guide and motivate SOC analysts.
• Minimum of 2 years of experience applying a deep understanding of cybersecurity concepts, including network security, threat intelligence, and incident response, in a SOC setting.
• Proven experience and expertise in SIEM tools and security monitoring technologies.

Desired

• Experience managing SOC operations on federal government contracts as a contractor, including meeting contract service level agreements and reporting to government SOC leadership.
• Experience with the Elastic Security Stack (SIEM, EDR, SOAR).
• Experience with federal incident reporting requirements, including OMB M-21-31 and coordination with CISA.
• Experience managing SOC coverage of industrial control system (ICS) environments.
• Certifications such as GCIH, GSOM, or CISM.

Work Authorization/Clearance: Must be a US Citizen and have or are able to obtain a Federal Government Public Trust clearance.

#LinkedIn #Dice

Salary: 160000.0 - 205000.0 USD