SOC Manager

Revolutional; Tacoma (WA); On-site; USD 140,000 - 200,000; Full time

Job summary

Revolutional in Washington, DC is seeking an experienced SOC Manager to lead a 24x7 security operations center serving federal contracts, overseeing on-premises and cloud environments.

You will manage contractor staff, drive incident response, develop playbooks, report to the client SOC lead, and coordinate with CISA and other partner SOCs to ensure rapid detection and remediation. Must be a US citizen with ability to obtain a Public Trust clearance.

Qualifications

• Bachelor's degree in CS or IT field; 10+ years running a SOC.
• 10 years in cybersecurity incident response across 50,000+ endpoints with full NIST functions.
• CISSP or equivalent certification.
• U.S. citizenship and ability to obtain Public Trust clearance.

Responsibilities

• Lead around-the-clock SOC operations across on-premises and cloud environments.
• Drive the incident response process from detection through closure.
• Communicate SOC performance, incidents, and trends to senior management.
• Mature SOC processes, playbooks, and performance measurement.
• Manage contractor SOC staff and shift managers to ensure 24x7 coverage.
• Develop the SOC Communications Plan and SOPs for all SOC processes.
• Coordinate with external organizations including CISA and partner SOCs.

Skills

SOC management

Leadership

Incident response

NIST CSF

CISSP

SIEM

Federal contracts

Education

Bachelor's degree in CS/IT

Tools

Elastic Security Stack

SIEM

Job description

Location: Onsite - Washington, DC (telework at client discretion)

Terms: Full-time

Clearance: Public Trust

Travel: Minimal - occasional CONUS travel (approximately one week per year)

Position Description

We are seeking an experienced SOC Manager to lead and oversee a team of security analysts within a federal Security Operations Center (SOC) that operates 24x7x365 across on-premises and cloud environments. The SOC Manager is responsible for continuously monitoring and responding to cyber threats by detecting, analyzing, and mitigating security incidents, developing security policies and procedures, and ensuring compliance with security standards. This role leads the incident response process, manages the contractor SOC staff, and reports to the client's SOC lead.

The successful candidate will:

• Lead effective, around-the-clock SOC operations across on-premises and cloud environments.
• Drive the incident response process from detection through closure.
• Communicate SOC performance, incidents, and trends clearly to senior management.
• Mature SOC processes, playbooks, and performance measurement.

Responsibilities:

• Manage the contractor SOC staff, reporting to the client's SOC lead and assigning and deploying staff to achieve SOC objectives identified by the client.
• Lead the incident response process, including coordinating investigations, assigning tasks to analysts, and escalating critical incidents to relevant stakeholders.
• Direct shift managers who oversee staff activity on each shift to provide 24x7x365 management coverage, including escalation contacts, and delegate management authority during absences.
• Develop the SOC Communications Plan describing how the SOC Manager communicates with the client SOC lead, client leadership, and SOC staff.
• Create and maintain SOC process documentation, incident and event playbooks, and Standard Operating Procedures for all SOC processes.
• Train SOC staff in the execution of operating procedures and collaborate with client staff on these procedures.
• Develop and implement a quality management program to track SOC performance and assess changes in performance over time.
• Assess and manage SOC resource needs to maintain optimal performance.
• Use Security Information and Event Management (SIEM) tools to aggregate and analyze security logs for threat detection.
• Oversee real-time alert monitoring and triage, incident report intake and coordination, incident analysis, forensic and malware analysis, and containment, eradication, and recovery activities.
• Provide oversight and guidance for all cyber incidents, and ensure incidents are closed only after all remediation and reporting activities are complete.
• Coordinate with external organizations, including CISA and partner SOCs, under the direction of the client lead.
• Coordinate fly-away incident response at remote locations when directed, with the team able to deploy within 24 hours.
• Support the SOC Performance and Investment Metrics Program, and generate reports on security incidents and trends, communicating key findings to senior management.

Required Skills and Experience

• Bachelor's degree in Computer Science or an IT-related discipline and Ten (10) years of experience running a SOC, with at least five (5) years of experience running a combined on-premises/cloud SOC.
• Ten (10) years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints, with duties that include all five functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover).
• CISSP or equivalent certification. (Equivalent certification covers a similar level of information security domains or depth of knowledge and/or experience.)
• Demonstrated leadership and team management abilities to guide and motivate SOC analysts.
• Minimum of 2 years of experience applying a deep understanding of cybersecurity concepts, including network security, threat intelligence, and incident response, in a SOC setting.
• Proven experience and expertise in SIEM tools and security monitoring technologies.
• Experience managing SOC operations on federal government contracts as a contractor, including meeting contract service level agreements and reporting to government SOC leadership.
• Experience with the Elastic Security Stack (SIEM, EDR, SOAR).
• Experience with federal incident reporting requirements, including OMB M-21-31 and coordination with CISA.
• Experience managing SOC coverage of industrial control system (ICS) environments.
• Certifications such as GCIH, GSOM, or CISM.

Work Authorization/Clearance: Must be a US Citizen and have or are able to obtain a Federal Government Public Trust clearance.