SOC Lead – Cyber Defense (TS/SCI)

cFocus Software Incorporated; Linthicum, Northern (MD, KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This on-site role is based in Linthicum Heights, MD and requires an Active TS/SCI clearance.

You will lead SOC analysts, coordinate threat hunting and incident response, and ensure timely reporting to Government stakeholders. The position demands strong judgment and collaboration across IT, OT, and cybersecurity teams.

Qualifications

• Active TS/SCI clearance.
• B.S. Computer Science, Information Technology, or a related field.
• Experience leading SOC personnel or defensive cybersecurity operations.
• Experience directing alert triage, threat hunting, investigations, and incident response.
• Ability to manage operational priorities, analyst development, coverage, and handoffs.
• Knowledge of networks, endpoints, cloud environments, logs, and cyberattack techniques.
• Experience with security monitoring, endpoint detection, vulnerability tools, and detection tuning.
• Ability to coordinate remediation and response across operations, engineering, and cybersecurity teams.
• Understanding of evidence handling, secure configurations, compliance records, and operational risk.
• Strong judgment and communication skills for timely Government reporting and incident coordination.

Responsibilities

• Lead SOC analysts and assigned response personnel; prioritize work, coach staff, review investigations, and maintain accountability for actions.
• Plan staffing, coverage, on-call rotations, and handoffs to support on-site and global response capabilities.
• Support SOC stand-up planning, tool configuration, sensor integration with C2 nodes, and enterprise scanning readiness.
• Coordinate centralized defensive operations, including monitoring, threat hunting, and incident response.
• Oversee alert triage and analysis of security events and trends; validate findings, assess mission impact, and direct approved mitigations.
• Lead data and intelligence-driven threat hunting and anomaly investigations across DC3 IT and OT environments.
• Direct incident detection, investigation, escalation, containment, eradication, and recovery; inform Government stakeholders.
• Review investigation evidence, timelines, and reports; ensure actions and handoffs are documented.
• Coordinate weekly vulnerability assessments with certified specialists; prioritize findings and track remediation with teams.
• Maintain effective C2 coordination with CSSPs, AFCYBER OC, and higher authorities.
• Manage assigned cyber orders and taskers, coordinate implementation, and support POA&Ms and compliance documents.
• Assess SOC tools, telemetry coverage, and resource needs; recommend procurement and improvements.
• Maintain incident response procedures, escalation guides, and documentation; incorporate lessons learned and updates for Government approval.
• Coordinate with ISSOs and ISSM to provide monitoring evidence supporting RMF and authorization.
• Recommend improvements based on emerging threats and technologies, including benefits, risks, and implementation approaches.

Skills

TS/SCI clearance

SOC leadership

Staffing coaching

Threat hunting

Incident response

Networks & cloud

Monitoring tools

Evidence handling

Govt reporting

Education

B.S. Computer Science / IT or related

Job description

cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This on-site role is based in Linthicum Heights, MD and requires an Active TS/SCI clearance.

You will lead SOC analysts, coordinate threat hunting and incident response, and ensure timely reporting to Government stakeholders. The position demands strong judgment and collaboration across IT, OT, and cybersecurity teams.