About this role

Job Responsibilities

- SOC Operations & Personnel Management: Direct daily SOC operations, oversee Tier I, II, and III security analysts, manage staffing and shift coverage schedules, and ensure continuous security monitoring, operational readiness, and effective execution of incident response activities across federal enterprise environments.

- Incident Response Leadership & Coordination: Manage the full incident response lifecycle, including detection, analysis, containment, eradication, and recovery. Coordinate response efforts across cybersecurity teams, IT operations, cloud service providers (CSPs), and federal stakeholders to minimize operational disruption and security risk.

- Security Monitoring & SOC Technology Oversight: Oversee the operational effectiveness of Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), and Continuous Diagnostics and Mitigation (CDM) technologies. Manage SIEM event notables, dashboards, and alert prioritization to maintain enterprise security visibility.

- Incident Investigation & Continuous Improvement: Lead post-incident reviews, root cause analysis, and lessons-learned activities to identify security control deficiencies, improve detection capabilities, and implement corrective actions that strengthen the organization's overall cybersecurity posture.

- SOC Documentation & Process Management: Develop, maintain, and continuously improve Standard Operating Procedures (SOPs), incident response playbooks, Concepts of Operations (CONOPS), escalation procedures, and other operational documentation to ensure consistent and efficient SOC execution.

- Federal Compliance & Incident Response Standards: Ensure SOC operations and incident response activities align with NIST SP 800-61, applicable federal cybersecurity requirements, and customer-specific incident response policies, procedures, and reporting obligations.

- Operational Communications & Stakeholder Coordination: Maintain SOC escalation call trees, emergency contact information, and communication protocols for internal teams, partner organizations, and cloud service providers. Lead operational briefings, shift transitions, and incident communications to ensure timely coordination and leadership awareness.

Job Requirements

- Cybersecurity & Incident Response Experience: Minimum of 8 years of progressive IT or cybersecurity experience, including at least 4 years of hands-on incident response experience, with demonstrated responsibility for managing security operations, coordinating incident investigations, and supporting complex enterprise environments.

- Professional Certifications: Must possess at least one of the following certifications: GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Analyst (GCFA), GIAC Reverse Engineering Malware (GREM), or an equivalent industry-recognized cybersecurity certification.

- SOC Leadership & Operational Management: Proven experience managing or leading a Security Operations Center supporting complex enterprise systems, including oversight of Tier I, II, and III personnel, 24/7 operational coverage, incident escalation, shift scheduling, and security operations processes.

- Security Technologies & Incident Analysis: Demonstrated hands-on experience with SIEM, SOAR, EDR, CDM, and malware analysis tools, including security event correlation, threat investigation, incident response automation, and development or management of security monitoring dashboards.

- Operating Systems, Networking & Cloud Security: Strong technical understanding of Windows and Linux operating systems, enterprise networking, security protocols, and AWS-native security services and tools, with the ability to oversee incident detection, investigation, and response across on-premises and cloud environments.