We are seeking a SOC Project Manager - SOC Lead (Secret Clearance) to lead and manage all Security Operations Center functions. The SOC Lead will ensure unified service delivery across sub-task areas, provide operational direction and influence executive leadership to align security operations with enterprise objectives. The SOC Project Manager - SOC Lead role requires deep expertise in SOC management, incident response and hybrid on-premises/cloud environments. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.
What you'll be doing:
- Lead a 24x7x365 SOC for unclassified environments. Ensure shift managers and escalation contacts cover every shift and on-call support is available for incident response.
- Coordinate task execution across sub-task leads to achieve enterprise-level objectives.
- Oversee the integration and coordination of on-premises and cloud-based SOC capabilities.
- Communicate effectively with executive leadership and stakeholders on SOC performance and posture.
- Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond and Recover.
- Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.
- Serve as, or direct, the Incident Commander for significant and widespread incidents. Responsibilities include:
- leading incident calls
- coordinating response across all teams and task orders
- managing government notifications and stakeholder communications
- tracking after-action items through remediation
- Direct the task order incident coordinators within each sub-task area. Ensure playbook adherence and full incident lifecycle documentation in the ticketing system.
- Oversee required reporting to federal oversight bodies, the Inspector General and law enforcement. Oversee reporting of classified spills onto unclassified systems.
- Coordinate with interagency and intelligence community partners such as CISA, the FBI and DHS.
- Execute the operational side of SOC consolidation:
- onboarding new customer organizations' log sources and alerting
- standardizing detection logic, escalation protocols and playbooks
- transitioning onboarded organizations into steady-state operations and maintenance
- Develop and maintain SOPs, incident response playbooks, an alert severity and triage framework, and standardized reporting templates.
- Own SOC performance metrics: mean time to detect, mean time to respond, alert volumes, false positive rates, ticket closure rates and SLA compliance. Explain any deviations and propose corrective actions.
- Build a centralized incident knowledge base and lessons-learned repository that is shared across customer organizations.
- Lead adoption of AI-enabled analytics and next-generation security automation.
- Train SOC staff on operating procedures and ensure analysts maintain tool proficiency.
What you need to know:
- Strong background in cybersecurity incident response across large, complex enterprise environments.
- Proven ability to align SOC functions with the NIST Cybersecurity Framework.
- Experience coordinating subordinate managers and technical leads to deliver cohesive operations.
- Skilled at influencing executive leadership and driving organizational adoption of SOC best practices
- Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.
- Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII) and vulnerability tools (Tenable, Qualys).
- Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention and escalation structures.
- Familiarity with federal incident reporting requirements and OMB M-21-31 event logging maturity.
Must have's:
- Bachelor's degree or 3+ additional years of relevant experience in lieu of degree.
- 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints), including 5+ years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.
- Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
- Applicants must hold and maintain an active Secret clearance.
Beneficial to have the following:
- Hold one or more of the following active certifications: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Manager (GSOM), or Certified Information Security Manager (CISM).
- Experience integrating multiple organizations into a consolidated SOC.
Where it's done:
