Senior SOC Incident Commander — Remote near NCR

ecsfederal; Virginia (MN); Hybrid; USD 140,000 - 160,000; Full time

Job summary

Everforth ECS is seeking an Incident Detection/Response Manager (SOC Manager) who will lead a 24x7 SOC supporting a major federal civilian agency. You will direct incident response operations, coordinate with threat hunting, security engineers, and agency stakeholders, and act as incident commander during incidents.

Responsibilities include managing SOC daily activities, ensuring SOPs and playbooks are current, and driving continuous improvement in detection and response capabilities.

Qualifications

• 8+ years of IT experience with 4+ years in incident response and SOC operations.
• Strong written and verbal communication skills for technical and executive audiences.
• Experience coordinating containment, eradication, and recovery during security incidents.
• Familiarity with incident response frameworks (NIST SP 800-61, MITRE ATT&CK).
• Hands-on with SIEM, SOAR, EDR tools and threat intel integration.

Responsibilities

• Manage SOC daily activities, shift schedules, and maintain SOPs, Playbooks, and CONOPS.
• Oversee Tier I–III incident response across a large enterprise with consistent, high-quality response.
• Coordinate containment, eradication, and recovery during active incidents as incident commander.
• Lead post-incident reviews and root-cause analysis for continuous SOC improvement.
• Ensure compliance with NIST SP 800-61 and related incident response procedures.

Skills

Incident response leadership

Communication skills

Team collaboration

Documentation

Tools

SIEM

SOAR

EDR

CDM

Job description

Everforth ECS is seeking an Incident Detection/Response Manager (SOC Manager) who will lead a 24x7 SOC supporting a major federal civilian agency. You will direct incident response operations, coordinate with threat hunting, security engineers, and agency stakeholders, and act as incident commander during incidents.

Responsibilities include managing SOC daily activities, ensuring SOPs and playbooks are current, and driving continuous improvement in detection and response capabilities.