Senior SOC Lead - Evening Shift, Federal Cloud Security

The Phoenix Group; Arlington (VA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Fixed schedule

Four-day rotation awareness

Shift premium

Certification support

Published salary bands

Visible impact

Job summary

The Phoenix Group is seeking a highly experienced Security Operations Lead to supervise an evening shift and oversee incident response for high-stakes federal clients. You will define escalation criteria, drive root-cause analysis, and maintain robust runbooks to prevent recurrences.

Ideal candidates have 5+ years in security operations and a proven track record of mentoring teams, with strong cloud security monitoring and FedRAMP experience.

Qualifications

• Five or more years in security operations, including time as the senior person on a floor.
• Track record of developing people, not only of resolving incidents.
• Strong grounding in cloud security monitoring, detection engineering and incident response.
• The confidence to set a standard and hold the team to it.

Responsibilities

• Lead the evening shift as the senior person on the floor from 14:00 to 22:00.
• Set the escalation criteria — what wakes a manager, what waits, and what the team handles alone.
• Run root cause on anything that reached containment, and update the runbook so it doesn’t recur.
• Set and hold the standard for shift logs, handovers and queue health across all shifts.
• Develop the Tier 1 and Tier 2 analysts. Their readiness for promotion is part of your job.
• Represent the team in incident reviews and FedRAMP evidence work.

Skills

Security operations

Incident response

Cloud security monitoring

Team leadership

Mentoring

FedRAMP

Job description

The Phoenix Group is seeking a highly experienced Security Operations Lead to supervise an evening shift and oversee incident response for high-stakes federal clients. You will define escalation criteria, drive root-cause analysis, and maintain robust runbooks to prevent recurrences.

Ideal candidates have 5+ years in security operations and a proven track record of mentoring teams, with strong cloud security monitoring and FedRAMP experience.