Senior Multi-Tenant SOC Lead & IR Strategist

EXOS; Indianapolis (IN); On-site; USD 140,000 - 190,000; Full time

Job summary

EXOS is seeking a seasoned SOC Manager to lead and evolve our security operations across a multi-tenant client base. You will own detection, response, and reporting while guiding a team of analysts and engineers.

This player-coach role demands hands-on IR, digital forensics, and adversary emulation to strengthen detections and playbooks. You will hire, coach, and develop the SOC staff, partnering with cyber leadership on service strategy.

Qualifications

• 8+ years in security operations, incident response, or MSP/MSSP roles, incl. 3+ years leading a SOC/IR team
• Proven incident commander on ransomware, BEC, and account compromise
• Hands-on digital forensics and IR background (host, memory, network)
• Penetration testing/adversary emulation experience applied to detections
• Advanced command of EDR and SIEM at query/detection level
• Knowledge of network/perimeter controls incl. NGFWs and cloud email security
• Experience building SOC processes, runbooks, escalation criteria, and metrics
• Track record of hiring, coaching, and developing analysts/engineers
• Strong IR lifecycle and MITRE ATT&CK knowledge
• Executive communication skills and SLA ownership
• CISSP or CISM, GIAC GCIH or equivalent

Responsibilities

• Lead day-to-day SOC operations across multiple client tenants, owning queue health and SLA performance
• Serve as incident commander for major incidents and guide containment, eradication, and recovery
• Drive after-action reviews to improve detections, playbooks, and client guidance
• Oversee timeline reconstruction, evidence handling, and legal coordination during incidents
• Lead purple team exercises and translate attacker TTPs into validated detections
• Hire, coach, and review SOC staff and develop internal career paths
• Set tooling direction and prioritize updates across SentinelOne, CrowdStrike, Splunk, and Cisco security products
• Own detection strategy, MITRE ATT&CK alignment, and automation partnerships
• Develop runbooks, QA programs, and KPI reporting (MTTA/MTTR/false positives)
• Present monthly security reviews and translate findings into business decisions
• Collaborate with account management and leadership on onboarding and scoping new engagements

Skills

Incident response leadership

Digital forensics

Threat hunting

EDR management

SIEM management

Education

Bachelor's or Master's in Cybersecurity

Tools

SentinelOne

CrowdStrike

Splunk

Cisco Firepower

Cisco ASA

Cisco Umbrella

DNSFilter

Avanan

Job description

EXOS is seeking a seasoned SOC Manager to lead and evolve our security operations across a multi-tenant client base. You will own detection, response, and reporting while guiding a team of analysts and engineers.

This player-coach role demands hands-on IR, digital forensics, and adversary emulation to strengthen detections and playbooks. You will hire, coach, and develop the SOC staff, partnering with cyber leadership on service strategy.