We are seeking a hands-on Security Operations Center (SOC) Manager to turn our Microsoft Sentinel and Microsoft Defender XDR foundation into a high-performing, intelligence-driven SOC. This technical leader will guide internal analysts and MSSP-supported operations while improving detection quality, investigation workflows, incident response, automation, telemetry management, KPI/KRI dashboards, and analyst development. The ideal candidate has senior/Tier 3-level SOC experience and is ready to build the operating model, metrics, capabilities, and team culture thattakeour cyber defense program to the next level.

Salary Range

The salary range for this position is $98,4/yr - $199,000/yr plus bonus. The base salary indicated for this position reflects the compensation range applicable to all levels of the role across the United States. Actual salary offers within this range may vary based on a number of factors, including the specific responsibilities of the position, the candidate27s relevant skills and professional experience, educational qualifications, and geographic location.

KeyAccountabilities

• Lead daily SOC operations across internal and MSSP-supported monitoring, alert triage, investigation, escalation, incident response, threat hunting, and continuous improvement.

• Own and evolve the MSSP relationship, including eyes-on-glass coverage, initial triage, handoffs, escalation quality, shared metrics, service improvement, and alignment to the internal SOC operating model.

• Implement, evaluate, and govern AI-assisted investigation and response capabilities that improve speed, consistency, evidence quality, and analyst effectiveness.

• Ensureappropriate SOCstaffing, workload balance, shift handoffs, on-call readiness, and escalation coverage across internal, MSSP-supported, and hybrid operating models.

• Define, visualize, and improve SOC KPIs and KRIs through dashboards and recurring reporting thatconnectoperational performance, control effectiveness, risk trends, and business impact.

• Mature Microsoft Sentinel capabilities, including analytics rules, KQL, workbooks, automation, playbooks, data connectors, parsing, and cost-aware log ingestion decisions that route high-value telemetry to Sentinel and lower-value or historical data to lake, archive, or cold storage.

• Use Microsoft Defender XDR to connect signals across endpoint, identity, email, and cloud app activity, improving incident correlation, advanced hunting, investigation quality, and response speed.

• Improve detection quality through false-positive reduction, coverage-gap closure, MITRE ATT&CK alignment, threat intelligence, hunting, validation testing, and purple-team lessons learned.

• Establish detection and use-case lifecycle governance, including ownership, documentation, testing, tuning, retirement, and periodic coverage reviews.

• Lead, coach, and develop SOC analysts through mentoring, technical reviews, structured training,investigationwalk-throughs, tabletop exercises, and hands-on skill development.

• Coordinate major incident response, including playbook execution, escalation paths, evidence handling, executive-ready communications, after-action reviews, and response improvement.

• Partner with infrastructure, cloud, endpoint, identity, vulnerability management, governance, legal, compliance, privacy, and business teams to improve visibility, control effectiveness, and response readiness.

Key Competencies for Position

• Develops Talent -Advocates for talent development as an organizational imperative and develops people according to talent strategy needs cultivating a diverse succession 2pipeline2.Continuously assesses talent across the bank to develop an understanding of capabilities and potential and leverages talent as a corporate resource to meet needs today and into the future.Cultivates an environment of trust andoptimizesothers' talents and capabilities across theorganization,driving a culture of continuous coaching and feedback.Retains,attractsand recruits top diverse talentleveragingopportunistic hires to meet current and futurepeopleneeds at Old National.

• Promotes Change -Explains thebusinessneed, impact, andanticipatedbenefits of the change while engaging stakeholders to gain buy-in. Shapes and transforms culture by building an organizational culture of change agility. Manages risk associated with the change throughappropriate contingencyplanning.Promotes change where it is needed to stay relevant and successful while creating conditions for team members to creatively generate new ways to enhance Old National's ability to succeed.

• Strategy in Action -Develops, communicates, and aligns organization witha clear visionand strategy empowering team members totake action. Maintains a strong network of advisors and leverages resources to stay current on emerging trends and market factors that may influence ONB27s strategy. Envisions how Old National's responses to trends mayimpactour longer-term vision and strategy while formulating a clear strategy that will accelerate ONB towards its strategic goals.Challenges the status quo to develop new ways ofthinkingencouraging curiosity beyond the current state.Conveys opportunities to realize the organization27s purpose, strategy, and culture in a way that captures attention, arousesemotionand compels others to act despite obstacles.

• Compelling Communication -Conveys transparent messages logically, simply, succinctly and at the right pace while being in command of the message. Captivatesaudiencethrough compelling language tailored to the audience27s expectations and communication style. Checks for understanding and presents messages indifferent waysto enhancereceiver27sunderstanding. Listens and objectivelyconsidersothers27 ideas and perspectives while encouraging others to do the same while addressing negative reactions to others27 ideas that jeopardize this open exchange.

• Makes Decisions & Solves Problems -Analyzes, contrasts, combines and compares data to define the most relevant organizational problems and opportunities and gain clarity on potential impact. Creates sound strategies by gathering information throughlistening,deep questions, challengingassumptionsand collaborating with networks in and outside of Old National. Aligns efforts and resources around blue chips and formulates decisions on relevant factors (e.g., costs, benefits, buy-in, risks) with the greatest potential for positive impact. Sets strategic direction for short-and long-term goals whileremainingagile to adjust plans to close current gaps,modifyingpriorities as circumstances change.

• Delights Clients -Cultivates an environment where team members passionately serve internal/external clients with excellence. Promotes a growth mindset culture by keeping current with development and trends in industry and sharing information to build knowledge base of organization and netpromotorscore. Understands data,metricsand/or financial information and how they tie to clients, business outcomes,organizationand industry.Empowers a culture of accountability across the organization where all team members nurture client relationships by listening, prioritizing, and acting responsibly tomeet clientneeds, mitigate risk and add shareholder value.

• Leads Inclusively -Advocates the value of diversity as a competitive advantage and initiates and champions inclusive recruiting and development processes that challenge the status quo, when necessary, to increase diversity in the workplace.Sets upoutreach systems and processes that seek ideas, opinions, and insights from diverse sources and whileoptimizingeffectiveness by aligning individuals27 unique talents, interests and abilities with the most relevant roles and responsibilities.Thinks with an inclusivelenspromotes inclusion by actively leading DEI initiatives while encouraging all team members to engage in DEI experiences.Demonstratesself-awareness, admitsmistakesand seeks feedback from all levels within Old National while acknowledging and challenging bias (conscious and unconscious) and exclusionary behavior.

• Personifies ONB Culture-Instills confidence in one27s actions and outcomes consistent with Old National's culture. Promotes the organization27s vision, strategy, and values while recognizing behavior that supports the vision and values. Conveys opportunities to realize the organization27s purpose, strategy, and culture in a way that captures attention, arousesemotionand compels others totake actiondespite obstacles. Inspires others to personally contribute to the organization27s success for the long term by investing time, heart, andexpertiseto help clients and communities thrive.

RequiredQualifications and Education Requirements

• Bachelor27s degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent hands-on experience.

• 7+ years of hands-on cybersecurity operations experience, including at least 2 years in a SOC manager, SOC lead, or senior/Tier 3 technical SOC role.

• Experience managing SOC staffing, coverage models, shift handoffs, on-call expectations, workload distribution, or capacity planning in an internal, MSSP-supported, or hybrid SOC environment.

• Experience hiring, onboarding, coaching, and performance-managing SOC analysts or security operations team members.

• Strong hands-on experience with Microsoft Sentinel and log pipeline tooling such as Cribl, including KQL, analytics rules, incidents, workbooks, automation, parser development, SIEM tuning, and cost-aware telemetry decisions that shape, filter, enrich, route, and optimize security logs before they reach Sentinel or longer-term storage.

• Strong hands-on experience with Microsoft Defender XDR and related Defender products, especially endpoint, identity, email, cloud app, incident correlation, advanced hunting, and response workflows.

• Demonstrated ability to build, track, visualize, and improve SOC KPIs, KRIs, dashboards, and operational reporting that show security value, risk reduction, and team effectiveness.

• Deep understanding of incident response, security monitoring, telemetry, identity-based attacks, cloud security, malware behaviors, adversary tactics, and the development of playbooks, escalation models, detection logic, threat hunting methods, and analyst enablement materials.

• Experience with scripting or automation using PowerShell, Python, KQL, Logic Apps, APIs, or similar tools.

• Familiarity with MITRE ATT&CK, threat modeling, cyber kill chain concepts, and mapping detections to adversary behaviors.

• Experience managing or partnering with an MSSP, MDR provider, or outsourced SOC function, including service expectations, escalation quality, operational handoffs, continuous improvement, shared metrics, and vendor accountability.

• Ability to set clear expectations, prioritize work, hold teams accountable, and create a culture of operational excellence and continuous improvement.

• Strong communicationskills with the ability to explain technical findings, operational risk, and incident status to technical teams, business stakeholders, and leadership.

Preferred Qualifications

• Experience leading SOC modernization, SIEM migration, Defender XDR rollout, Sentinel detection content lifecycle management, or security automation initiatives.

• Experience in financial services, banking, regulated environments, or organizations with mature governance, risk, compliance, audit, and privacy expectations.

• Relevant certifications such as CISSP, GCIH, GCIA, GCFA, GNFA, GMON, SC-200, AZ-500, MS-500, OSCP, or equivalent practical experience.

• Experience with cloud security across Azure, AWS, or GCP, including cloud logging, identity, workload protection, and incident response.

• Experience designing purple-team scenarios,validatingdetec