Hybrid Cybersecurity Operations Manager – SOC Leader

Lyra Technology Group; Jacksonville (FL); Hybrid; USD 90,000 - 100,000; Full time

Job summary

Lyra Technology Group is seeking a Cybersecurity Operations Manager to lead and grow the SOC for multiple managed clients in a hybrid Jacksonville, FL setting. You will own incident response, detection, and operational excellence while mentoring the SOC team and coordinating with MDR/SIEM partners.

The role demands 4–6 years in cybersecurity, 2+ years in leadership, MSP/MSSP experience preferred, and strong knowledge of EDR/XDR, SIEM, and identity security.

Qualifications

• 4 to 6 years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents.
• 2 or more years in a leadership role, formal or informal, including mentoring or directing other analysts.
• MSP, MSSP, or multi-client environment strongly preferred.
• Strong working knowledge of endpoint detection and response (EDR/XDR), SIEM and log management, identity and access management (Entra, Conditional Access), and email security.
• Familiarity with security frameworks (NIST, CIS, ISO) and compliance-driven environments; CMMC and NIST 800-171 experience is a plus.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.
• Preferred: Security+, CySA+, GCIH, or equivalent; CISSP, GCFA, or other advanced certifications are a plus but not expected.

Responsibilities

• Serve as the final escalation point for security alerts and incidents across all managed clients.
• Lead and develop the Cybersecurity Operations team with direct, hands-on coaching and clear accountability.
• Establish roles, expectations, KPIs, and escalation paths for the SOC team.
• Own queue health across all managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for the outcome.
• Work the security queue directly when volume exceeds team capacity or when SOC team members are unavailable.
• Oversee daily SOC operations, including monitoring, alert triage, and response.
• Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when an incident requires it.
• Improve detection logic, alert quality, and response workflows on an ongoing basis.
• Manage MDR and SIEM partner relationships and hold them to service expectations.
• Own the security outcomes managed clients experience: detection quality, response speed, containment, and client confidence.
• Serve as the senior technical voice in client-facing security conversations covering incidents, posture, reporting, and remediation.
• Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements.
• Develop and maintain runbooks, playbooks, and standard operating procedures.
• Track performance against response times, detection accuracy, and SLA adherence, and act on trends to reduce noise and improve efficiency.
• Partner with Advanced Services on detection engineering, automation, and tooling.

Skills

Cybersecurity ops

Leadership

Incident response

Communication

Education

Bachelor's degree in IT/Cybersecurity/CS

Tools

EDR/XDR

SIEM

Entra/Identity mgmt

Email security

Job description

Lyra Technology Group is seeking a Cybersecurity Operations Manager to lead and grow the SOC for multiple managed clients in a hybrid Jacksonville, FL setting. You will own incident response, detection, and operational excellence while mentoring the SOC team and coordinating with MDR/SIEM partners.

The role demands 4–6 years in cybersecurity, 2+ years in leadership, MSP/MSSP experience preferred, and strong knowledge of EDR/XDR, SIEM, and identity security.