SOC Manager

HW3; Jacksonville (FL); On-site; USD 120,000 - 180,000; Full time

Job summary

HW3 is seeking a Security Operations Center (SOC) Manager to lead a 24x7 security operations function across a complex global environment. You will mentor distributed analysts and drive threat detection and incident response capabilities.

The role blends hands-on operational leadership with strategic program development and governance, including SIEM/EDR/XDR enhancements and cross‑functional collaboration with risk, legal, and technology teams.

Qualifications

• 8+ years of experience in cybersecurity operations, threat detection, or incident response.
• Proven leadership of SOC teams or security operations functions.
• Strong knowledge of attacker TTPs and modern security controls.
• Hands-on experience with SIEM, EDR/XDR, and threat intelligence platforms.
• Excellent communication with technical and executive stakeholders.

Responsibilities

• Lead, mentor, and develop a distributed SOC team across regions and time zones.
• Drive threat detection, incident response, and playbook execution.
• Oversee day-to-day security operations, monitoring, and investigations.
• Support staffing, training, and on-call coverage for 24x7 operations.

Skills

SOC management

Threat detection

Incident response

Security engineering

Communication

Tools

SIEM

EDR/XDR

Threat intelligence

Job description

Security Operations Center (SOC) Manager

A large, globally recognized enterprise is seeking a SOC Manager to lead and continue maturing a 24x7 security operations function supporting a complex global environment.

This role will be responsible for leading a geographically distributed team of analysts, driving threat detection and incident response capabilities, and helping shape the future direction of the organization's security operations program. The successful candidate will combine hands‑on operational leadership with longer‑term strategic planning and process improvement.

Location

What You'll Be Doing

• Lead, mentor, and develop a distributed SOC team operating across multiple regions and time zones
• Foster a culture of accountability, collaboration, and continuous improvement
• Support hiring, training, workforce planning, and career development initiatives
• Manage staffing and on-call coverage to support 24x7 operations

Security Operations & Incident Response

• Oversee day-to-day security operations, including monitoring, investigation, containment, and response activities
• Ensure consistent execution of incident response procedures and operational playbooks
• Coordinate response efforts with internal technology, risk, legal, privacy, and business stakeholders
• Drive operational excellence across the incident management lifecycle
• Lead ongoing improvements across SIEM, XDR, NDR, threat intelligence, and related security technologies
• Enhance detection coverage, alert quality, and automation capabilities
• Monitor emerging threats and translate intelligence into actionable detection and response strategies

Reporting & Governance

• Establish and track key operational metrics including MTTD, MTTR, incident trends, and detection effectiveness
• Deliver reporting and insights to senior leadership
• Ensure alignment with security policies, regulatory requirements, and industry frameworks

Program Development

• Contribute to the ongoing evolution and maturity of the security operations program
• Identify opportunities for process optimization, automation, and technology enhancement
• Support vendor evaluations, technology selection, tabletop exercises, and security readiness initiatives

What We're Looking For

• 8+ years of experience within cybersecurity operations, threat detection, incident response, or security engineering
• Prior experience leading SOC teams or managing security operations functions
• Strong knowledge of attacker tactics, techniques, and procedures (TTPs)
• Hands‑on experience with enterprise security technologies including SIEM, EDR/XDR, and threat intelligence platforms
• Proven ability to lead teams during high‑pressure security events
• Strong communication skills with the ability to engage technical and executive stakeholders

Preferred Experience

• Experience within large-scale, highly regulated, or complex enterprise environments
• Familiarity with cloud security operations across AWS, Azure, or GCP
• Experience supporting globally distributed security operations teams
• Industry certifications such as CISSP, CISM, GCIH, GCED, or similar
• Experience supporting executive‑level communications during security incidents