Cybersecurity Operations Manager
$90k - $100k
Mid, Senior
Bachelor's
Jacksonville, FL, USA
HybridHybrid work in Jacksonville, Florida.
CybersecuritySecurity Operations & Incident Response
About the job
Requirements
- Four to six years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents.
- Two or more years in a formal or informal leadership role, including mentoring or directing other analysts.
- Strong working knowledge of endpoint detection and response (EDR/XDR), security information and event management (SIEM) and log management, identity and access management (Entra, Conditional Access), and email security.
- Ability to serve as the final technical decision-maker under pressure during active incidents.
- Familiarity with security frameworks (NIST, CIS, ISO) and compliance-driven environments.
- Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.
- Strong coaching, team development, and performance management capabilities.
- Ability to translate technical issues for business stakeholders.
- Problem-solving and decision-making under pressure.
Responsibilities
- Serve as the final escalation point for security alerts and incidents across all managed clients.
- Lead and develop the Cybersecurity Operations team through hands-on coaching and clear accountability.
- Establish roles, expectations, key performance indicators, and escalation paths for the SOC team.
- Own queue health across managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for outcomes.
- Work the security queue directly when volume exceeds team capacity or SOC team members are unavailable.
- Oversee daily SOC operations, including monitoring, alert triage, and response.
- Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when required.
- Improve detection logic, alert quality, and response workflows.
- Manage managed detection and response (MDR) and SIEM partner relationships and hold them to service expectations.
- Own managed clients' security outcomes, including detection quality, response speed, containment, and client confidence.
- Serve as the senior technical voice in client-facing security conversations covering incidents, posture, reporting, and remediation.
- Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements.
- Develop and maintain runbooks, playbooks, and standard operating procedures.
- Track performance against response times, detection accuracy, and service-level agreement adherence, and act on trends to reduce noise and improve efficiency.
- Partner with Advanced Services on detection engineering, automation, and tooling, including EDR/XDR, log and SIEM ingestion, identity protection, and email security.
- Coordinate security-related work with Support, NOC, and Professional Services.
- Ensure clean escalation and resolution across operational teams.
- Contribute to company-wide automation, artificial intelligence, and service delivery initiatives.
Desired Qualifications
- Experience in an MSP, MSSP, or multi-client environment.
- Experience with CMMC and NIST 800-171.
- Security+, CySA+, GCIH, or equivalent certification; CISSP, GCFA, or other advanced certifications are a plus but not expected.
About the company
Lyra Technology Group is a portfolio-based parent that builds a network of managed IT service providers (MSPs) across North America. It acquires MSPs and provides them with permanent capital, shared resources, and a community of peers, while allowing each acquired company to keep its brand, leadership, and culture and operate independently under its existing management. The group also operates Lyra Recovery, a division focused on ransomware and data breach remediation. Its approach centers on decentralized decision-making by local leaders, continuous growth through acquisitions, and ensuring that the independent MSPs retain their identity while benefiting from the backing and infrastructure of Lyra and Evergreen Services Group. The ultimate goal is to expand a large, coast-to-coast MSP network serving more than 10,000 organizations, by adding leading MSPs and supporting their growth without divestment, using permanent capital from its backers.
Company Size
51-200
Company Stage
N/A
Total Funding
N/A
Headquarters
Chicago, Illinois
Founded
2017
Get referred to Lyra Technology Group
See people who can refer or advise you
Simplify's Take
What believers are saying
- September 2026 Concept Data and Voice Select added South Australian healthcare and voice capabilities.
- June 2026 OSIT was Lyra's largest ANZ deal, expanding enterprise reach and ESOP credibility.
- Anthropic partnership positions Lyra for rising AWS AI budgets and managed deployment demand.
What critics are saying
- Evergreen's rollup model depends on continuous acquisitions; deal slowdown stalls growth.
- MSP integration across 71+ companies creates execution risk, especially after June 2026 ANZ expansion.
- Private-equity ownership under Alpine pressures returns; a weak exit market traps capital longer.
What makes Lyra Technology Group unique
- Lyra keeps acquired MSP brands, teams, and founders, preserving client trust.
- Evergreen never divests, giving Lyra permanent capital for patient MSP rollups.
- Lyra Cloud Services' 2026 Anthropic-AWS partnership adds AI operational services depth.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Health Insurance
- Unlimited Paid Time Off
- Flexible Work Hours
- Remote Work Options
- Paid Vacation
- 401(k) Retirement Plan
- 401(k) Company Match
- Wellness Program
- Mental Health Support
- Conference Attendance Budget
- Professional Development Budget
- Stock Options