Cybersecurity Operations Manager

Lyra Technology Group; Jacksonville (FL); Hybrid; USD 90,000 - 100,000; Full time

Job summary

Lyra Technology Group is seeking a Cybersecurity Operations Manager to lead and grow the SOC for multiple managed clients in a hybrid Jacksonville, FL setting. You will own incident response, detection, and operational excellence while mentoring the SOC team and coordinating with MDR/SIEM partners.

The role demands 4–6 years in cybersecurity, 2+ years in leadership, MSP/MSSP experience preferred, and strong knowledge of EDR/XDR, SIEM, and identity security.

Qualifications

• 4 to 6 years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents.
• 2 or more years in a leadership role, formal or informal, including mentoring or directing other analysts.
• MSP, MSSP, or multi-client environment strongly preferred.
• Strong working knowledge of endpoint detection and response (EDR/XDR), SIEM and log management, identity and access management (Entra, Conditional Access), and email security.
• Familiarity with security frameworks (NIST, CIS, ISO) and compliance-driven environments; CMMC and NIST 800-171 experience is a plus.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.
• Preferred: Security+, CySA+, GCIH, or equivalent; CISSP, GCFA, or other advanced certifications are a plus but not expected.

Responsibilities

• Serve as the final escalation point for security alerts and incidents across all managed clients.
• Lead and develop the Cybersecurity Operations team with direct, hands-on coaching and clear accountability.
• Establish roles, expectations, KPIs, and escalation paths for the SOC team.
• Own queue health across all managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for the outcome.
• Work the security queue directly when volume exceeds team capacity or when SOC team members are unavailable.
• Oversee daily SOC operations, including monitoring, alert triage, and response.
• Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when an incident requires it.
• Improve detection logic, alert quality, and response workflows on an ongoing basis.
• Manage MDR and SIEM partner relationships and hold them to service expectations.
• Own the security outcomes managed clients experience: detection quality, response speed, containment, and client confidence.
• Serve as the senior technical voice in client-facing security conversations covering incidents, posture, reporting, and remediation.
• Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements.
• Develop and maintain runbooks, playbooks, and standard operating procedures.
• Track performance against response times, detection accuracy, and SLA adherence, and act on trends to reduce noise and improve efficiency.
• Partner with Advanced Services on detection engineering, automation, and tooling.

Skills

Cybersecurity ops

Leadership

Incident response

Communication

Education

Bachelor's degree in IT/Cybersecurity/CS

Tools

EDR/XDR

SIEM

Entra/Identity mgmt

Email security

Job description

Lyra Technology Group is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group, we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.

About Scarlett Group

Scarlett Group is recognized as a JBJ Best Places to Work and is one of the fastest-growing technology companies in the region. We offer competitive benefits, opportunities for advancement, professional development support, and a culture built on collaboration, accountability, and having fun while doing meaningful work. Great benefits. Great people. Great opportunities. That's the Scarlett difference.

Your work as a Cybersecurity Operations Manager will include several components:

Security Leadership and Escalation

• Serve as the final escalation point for security alerts and incidents across all managed clients.
• Lead and develop the Cybersecurity Operations team with direct, hands-on coaching and clear accountability.
• Establish roles, expectations, KPIs, and escalation paths for the SOC team.
• Own queue health across all managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for the outcome.
• Work the security queue directly when volume exceeds team capacity or when SOC team members are on PTO, out, or otherwise unavailable – queue coverage is an expected part of this working leadership role, not an exception.

SOC and Incident Response

• Oversee daily SOC operations, including monitoring, alert triage, and response.
• Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when an incident requires it.
• Improve detection logic, alert quality, and response workflows on an ongoing basis.
• Manage MDR and SIEM partner relationships and hold them to service expectations.

Client Security Accountability

• Own the security outcomes managed clients experience: detection quality, response speed, containment, and client confidence.
• Serve as the senior technical voice in client-facing security conversations covering incidents, posture, reporting, and remediation.
• Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements.

Operational Excellence

• Develop and maintain runbooks, playbooks, and standard operating procedures.
• Track performance against response times, detection accuracy, and SLA adherence, and act on trends to reduce noise and improve efficiency.
• Partner with Advanced Services on detection engineering, automation, and tooling – including EDR/XDR, log and SIEM ingestion, identity protection, and email security – rather than maintaining a separate engineering function.

Cross-Functional Collaboration

• Coordinate security-related work with Support, NOC, and Professional Services.
• Ensure clean escalation and resolution across operational teams.
• Contribute to company-wide automation, AI, and service delivery initiatives.

Our Ideal Cybersecurity Operations Manager Has The Following Qualifications

• 4 to 6 years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents.
• 2 or more years in a leadership role, formal or informal, including mentoring or directing other analysts.
• MSP, MSSP, or multi-client environment strongly preferred.
• Strong working knowledge of endpoint detection and response (EDR/XDR), SIEM and log management, identity and access management (Entra, Conditional Access), and email security.
• Comfort serving as the final technical decision-maker under pressure during active incidents.
• Familiarity with security frameworks (NIST, CIS, ISO) and compliance-driven environments; CMMC and NIST 800-171 experience is a plus.
• Strong coaching, team development, and performance management capabilities.
• Excellent communication, including translating technical issues for business stakeholders.
• Sound problem-solving and decision-making under pressure.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.
• Preferred: Security+, CySA+, GCIH, or equivalent; CISSP, GCFA, or other advanced certifications are a plus but not expected.

This role will operate on a hybrid basis out of Jacksonville, FL and will host a base compensation of $90,000-$100,000.

We are seeking candidates who thrive as the dependable last line of decision-making when a security event escalates. If you are a hands-on security leader who wants ownership over both the SOC's day-to-day execution and its long-term outcomes, we would welcome the opportunity to speak with you.