Incident Detection/Response Manager (SOC Manager)

ECS Corporate Services; Fairfax (VA); Remote; USD 140,000 - 160,000; Full time

Job summary

Everforth ECS is seeking an Incident Detection/Response Manager to lead our 24x7 SOC supporting a major federal civilian agency. You will direct Tier I–III incident response, coordinate containment and recovery, and drive continuous improvement in detection capabilities.

The role requires US citizenship, 8+ years IT with 4+ years in incident response, and active Public Trust 6c or ability to obtain one. Proximity to NCR is preferred for on-site coordination.

Qualifications

• U.S. Citizenship required.
• 8+ years of IT experience with 4+ years in incident response/SOC operations.
• Active Public Trust 6c clearance or ability to obtain one.
• Experience with SIEM, SOAR, EDR, CDM, and malware analysis tools.

Responsibilities

• Manage SOC daily activities, shift schedules, and ensure SOPs/Playbooks/CONOPS are current.
• Oversee Tier I–III incident response across a large federal enterprise, ensuring quality responses.
• Act as incident commander during active incidents, coordinating with SOC, IT operations, and stakeholders.
• Lead post-incident reviews and root-cause analysis for lessons learned.
• Ensure compliance with NIST SP 800-61 and federal incident response procedures.
• Maintain SIEM dashboards and ensure timely triage and resolution of alerts.
• Maintain 24/7 SOC coverage schedule and contact trees for partner organizations and CSPs.
• Apply MITRE ATT&CK to map attacker TTPs during investigations and response.
• Collaborate with threat hunting, CTI, engineering, and architecture teams.

Skills

Incident response

SOC operations

Threat hunting

Communication

Security incident management

Tools

SIEM

SOAR

EDR

CDM

malware analysis tools

Job description

Everforth ECS is seeking an Incident Detection/Response Manager (SOC Manager) who lives in close proximity to the National Capital Region (NCR) to join a premier, enterprise-scale cybersecurity program supporting a major federal civilian agency. Please Note: This position is contingent upon contract award. Salary Range: $140,000 - $160,000 This flagship initiative unifies 24x7x365 Security Operations (SOC), proactive threat hunting, and advanced Security Engineering and Architecture into a cohesive defensive mission. As a key leader on this program, you will drive the protection of highly sensitive, national-level financial, and personally identifiable information (PII). You will be at the forefront of modernizing the agency's cyber posture, implementing advanced automation, and ensuring continuous operational resilience across a massive, highly complex federal IT enterprise.As the Incident Detection/Response Manager, you will serve as the operational commander of a high-performing, around-the-clock Security Operations Center supporting a major federal civilian agency. You will direct Tier I, II, and III incident response operations, ensuring rapid detection, containment, and recovery across a large-scale federal IT enterprise. Working closely with threat hunting teams, security engineers, agency stakeholders, and external service providers, you will lead the SOC's day-to-day operations while driving continuous improvement in detection capabilities, response procedures, and overall security posture. When incidents occur, you become the incident commander, orchestrating response from the moment a threat is detected through containment, eradication, and recovery.

Position Responsibilities:

• Manage SOC daily activities, including building and maintaining shift schedules and ensuring all documentation, including SOPs, Playbooks, and CONOPS, are current.
• Manage Tier I, II, and III incident response operations across the federal enterprise, ensuring consistent, high-quality response at every level.
• Coordinate containment, eradication, and recovery activities during active security incidents, serving as the primary incident commander and coordinating between the SOC team, IT operations, and relevant stakeholders.
• Lead post-incident reviews and root cause analysis to identify lessons learned and drive continuous improvement in SOC processes and detection capabilities.
• Ensure compliance with NIST SP 800-61 and federal incident response standard operating procedures across all SOC operations.
• Manage SIEM event "notables" dashboards, ensuring timely triage, escalation, and resolution of security alerts.
• Maintain the SOC coverage schedule per shift to ensure 24x7x365 operational readiness.
• Maintain the call tree, including current contact information for all partner organizations and Cloud Service Providers (CSPs).
• Apply MITRE ATT&CK framework to map attacker tactics, techniques, and procedures (TTPs) during investigations and incident response activities.
• Encourage team collaboration by fostering a positive team culture, managing workloads effectively, and supporting professional development.
• Collaborate with threat hunting, CTI, engineering, and architecture teams to ensure SOC operations are informed by the latest threat intelligence and detection capabilities.
• Present incident findings, risk recommendations, and SOC performance metrics to both technical teams and senior government officials in a clear, actionable format.
• Support the development and continuous improvement of a comprehensive enterprise information security program grounded in the latest laws, regulations, and industry best practices.
• U.S. Citizenship required.
• 8+ years of IT experience, with 4+ years of dedicated incident response and SOC operations experience.
• Remote but in close proximity to the NCR.
• Active Public Trust 6c clearance, or the ability to obtain and maintain one.
• At least one of the following certifications: GCIH, GCFA, GREM, or equivalent.
• Hands-on experience with SIEM, SOAR, EDR, CDM, and malware analysis tools and platforms.
• Strong experience with operating systems and networking fundamentals, including log analysis, traffic analysis, and endpoint forensics.
• Experience with AWS native services and tools in a federal or enterprise cloud environment.
• Demonstrated experience managing a SOC overseeing complex, large-scale federal or enterprise IT systems.
• Strong command of incident response frameworks in general, including NIST SP 800-61, SANS PICERL, and MITRE ATT&CK.
• Practical malware analysis fundamentals, including static analysis, sandboxing, and Indicator of Compromise (IoC) extraction.
• Experience with SOAR platforms to automate repetitive elements of incident response and improve analyst efficiency.
• Proven ability to translate complex technical findings into clear, actionable language for both technical and executive audiences.
• Strong written and verbal communication skills, with a track record of producing high-quality federal security documentation.