Security Operations Center Manager

The Role

What Success Looks Like

• Alert volume gets triaged fast enough that a real incident does not sit in a queue behind noise.
• Analysts know what to escalate and what to close, and the standard for that decision is written down rather than tribal knowledge.
• Recurring false positives get tuned out at the source instead of re-triaged every shift.

• Insider threat, threat hunt, incident response, forensics, and vulnerability assessment hand work to each other cleanly, without a finding stalling because nobody owned the next step.
• You can tell which function is under strain before it becomes the SOC's bottleneck.
• Coverage holds across shifts and gaps in staffing, rather than depending on who happens to be on duty.

• Reporting to leadership tells them what changed and what it means, not just a count of tickets closed.
• Risk that needs a decision above your level reaches that decision maker while there is still time to act on it.
• An incident's real severity and impact get communicated accurately the first time, not revised upward after the fact.

• Lessons from real incidents change how the SOC operates, not just what gets written in an after-action report.
• Analysts get better at their craft under you, not just busier.
• Standards and playbooks exist for the SOC's recurring work, and they get followed because they hold up under real conditions.

What You Bring

• You have run a security operations center or an equivalent detection and response function, not only worked inside one as an analyst.
• You have managed a team through a real incident and can describe what you would do differently.
• You have reported security posture and incidents to non-technical leadership and can describe what changed in how you communicate because of it.
• You have worked inside a federal or highly regulated security program and know what that adds to the job beyond the technical work.
• You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date.
• You are comfortable across the disciplines your team covers, insider threat, threat hunting, incident response, forensics, and vulnerability assessment, even where you are not the deepest technical expert in each.
• Certifications such as CISSP, GCIH, or CISM are useful, but they are not a substitute for having run the function.

A note on timing

Employee Benefits

• Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do.
• Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated.
• Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support.
• Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task.
• Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges.
• Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success.