cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

SOC Operations Lead / Managed Detection & Response Lead - Managed Detection & Response

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeWashington, DC, USANo salary listedIn-person

About the Job

Requirements

At least 10 years of cybersecurity operations experience.
At least 5 years leading enterprise Security Operations Center or Managed Detection & Response environments.
Experience supporting federal civilian or Department of Defense environments.
Experience managing large-scale Security Operations Center operations in environments exceeding 10,000 users, with enterprise cloud environments and large security information and event management deployments.
Experience with Splunk Enterprise Security, Microsoft Sentinel, CrowdStrike, endpoint detection and response or extended detection and response platforms, security orchestration, automation and response technologies, and cloud security monitoring.
Deep understanding of MITRE ATT&CK, incident response, detection engineering, and threat-informed defense.
Strong executive briefing and oral presentation skills.

Responsibilities

Lead enterprise Security Operations Center and Managed Detection & Response operations supporting on-premises and cloud environments.
Oversee 24x7 monitoring, detection, triage, and escalation activities.
Direct operational workflows for security information and event management monitoring, alert management, incident coordination, case management, and operational reporting.
Manage analyst teams supporting Splunk, Microsoft Sentinel, CrowdStrike, Sysmon, Windows event logging, and cloud telemetry platforms.
Develop and maintain Security Operations Center standard operating procedures, playbooks, runbooks, escalation matrices, and reporting procedures.
Lead operational metrics reporting, including mean time to detect, mean time to respond, false positive rates, automation effectiveness, analyst productivity, and incident impact assessments.
Coordinate closely with Threat Hunting, Cyber Threat Intelligence, Detection Engineering, and Incident Response teams.
Brief executives and government leadership on significant incidents, operational trends, and emerging threats.
Support proposal development, oral presentations, staffing, and transition planning.

Desired Qualifications

CISSP, GCIA, GCIH, GMON, or GSOC certification.
Splunk Architect or Administrator certifications.
Microsoft Security certifications.

Position Title
SOC Operations Lead / Managed Detection & Response (MDR) Lead
Position Overview
The SOC Operations Lead will oversee 24x7x365 Security Operations Center (SOC) and Managed Detection & Response (MDR) operations supporting a large federal enterprise environment. The Lead will direct SOC analysts, incident responders, and MDR personnel responsible for security monitoring, alert triage, incident analysis, escalation, containment coordination, reporting, and continuous operational improvement.
The ideal candidate possesses deep experience leading enterprise SOC operations supporting federal agencies, including SIEM operations, endpoint detection and response (EDR), cloud security monitoring, incident coordination, and executive cyber reporting.
Key Responsibilities

Lead enterprise SOC and MDR operations supporting on-premises and cloud environments.
Oversee 24x7 monitoring, detection, triage, and escalation activities.
Direct operational workflows for:
- SIEM monitoring,
- alert management,
- incident coordination,
- case management,
- and operational reporting.
Manage analyst teams supporting:
- Splunk,
- Microsoft Sentinel,
- CrowdStrike,
- Sysmon,
- Windows event logging,
- and cloud telemetry platforms.
Develop and maintain SOC SOPs, playbooks, runbooks, escalation matrices, and reporting procedures.
Lead operational metrics reporting including:
- MTTD,
- MTTR,
- false positive rates,
- automation effectiveness,
- analyst productivity,
- and incident impact assessments.
Coordinate closely with Threat Hunting, CTI, Detection Engineering, and Incident Response teams.
Brief executives and government leadership on significant incidents, operational trends, and emerging threats.
Support proposal development, oral presentations, staffing, and transition planning.

Required Qualifications

10+ years of cybersecurity operations experience.
5+ years leading enterprise SOC or MDR environments.
Experience supporting federal civilian or DoD environments.
Experience managing large-scale SOC operations in environments exceeding:
- 10,000+ users,
- enterprise cloud environments,
- and large SIEM deployments.
Experience with:
- Splunk Enterprise Security,
- Microsoft Sentinel,
- CrowdStrike,
- EDR/XDR platforms,
- SOAR technologies,
- and cloud security monitoring.
Deep understanding of:
- MITRE ATT&CK,
- incident response,
- detection engineering,
- and threat-informed defense.
Strong executive briefing and oral presentation skills.

Preferred Certifications

CISSP
GCIA
GCIH
GMON
GSOC
Splunk Architect/Admin certifications
Microsoft Security certifications

About the Company

cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It designs and manages security architectures, conducts risk assessments, ensures compliance, and delivers IT and geospatial data solutions tailored to federal requirements. The company differentiates itself through 18+ years of government-focused experience across dozens of agencies and established, government-facing delivery processes. Its goal is to help federal agencies protect, operate, and optimize their IT and geospatial capabilities for secure and compliant government operations.

Company size: 11-50
Company stage: Not listed
Total funding: Not listed
Headquarters: Largo, FL
Founded: 2006

Recently Posted Jobs

Explore more opportunities at cFocus Software

See more jobs