SOC Manager

Everforth, Inc.; United States; Remote; USD 140,000 - 220,000; Full time

Job summary

Everforth ECS seeks an experienced SOC Manager to lead analysts across 24x7 operations, driving people, processes, and performance. The role emphasizes high-severity incident handling, cross-team coordination, and continual improvement of detection and response capabilities.

The ideal candidate will manage staffing, coaching, and escalation, while maintaining strong customer communications and operational discipline in a multi-environment setting.

Qualifications

• 8+ years in cybersecurity with SOC, incident response, or related roles.

Responsibilities

• Lead and manage a team of SOC analysts for 24x7x365 operations.
• Maintain 24x7x365 SOC coverage and staffing plans.
• Ensure quality and timeliness of investigations, escalations, and communications.
• Coordinate complex investigations and cross-team incidents.
• Oversee multiple customer environments with different tech stacks.
• Track and improve SOC performance metrics and KPIs.
• Develop and refine SOC processes, playbooks, and escalation procedures.
• Collaborate with Detection Engineering, Threat Intelligence, IR, Red Team, and SOAR teams.
• Incorporate MITRE ATT&CK and adversary techniques into detection priorities.
• Support AI-assisted operations with human oversight.
• Assist in onboarding new customers and ensuring operational readiness.

Skills

SOC leadership

Incident response

Threat detection

Threat hunting

MITRE ATT&CK

Communication

Decision making

Cross-team coordination

Tools

Microsoft Sentinel

Splunk

Elastic Security

Defender XDR

CrowdStrike Falcon

SentinelOne

Trellix

Job description

As a leading managed cybersecurity services provider, ECS delivers highly tailored cybersecurity services across diverse customer environments. Our Security Operations Center operates in a fast-paced, multi-client environment where strong technical judgment, operational discipline, customer communication, and effective leadership are essential.

ECS is seeking an experienced SOC Manager to lead analysts supporting our 24x7x365 managed security operations. This position is responsible for the people, processes, and operational execution required to deliver consistent, high-quality detection, investigation, escalation, and incident response services across multiple customer environments.

The SOC Manager serves as both a people leader and senior operational escalation point. The ideal candidate has significant experience leading security operations personnel, understands modern SOC technologies and investigative techniques, can manage competing customer priorities, and is comfortable making decisions during high-severity cybersecurity events. The role requires working across security disciplines and customer teams to improve detection and response capabilities, strengthen operational processes, and continuously improve the effectiveness of SOC services.

Responsibilities

• Lead and manage a team of SOC analysts supporting 24x7x365 managed security operations, including recruiting, staffing, scheduling, workload management, onboarding, coaching, performance management, technical development, retention, and career development.
• Maintain effective 24x7x365 SOC coverage, including staffing levels, shift coverage, workload distribution, escalation coverage, leave coordination, and identification of coverage or skills gaps that could affect service delivery.
• Maintain accountability for the quality, consistency, and timeliness of SOC investigations, escalations, customer communications, and operational deliverables.
• Serve as a senior operational escalation point for complex investigations, customer issues, high-severity incidents, and situations requiring management judgment or cross-team coordination.
• Manage security operations across multiple customer environments with differing technology stacks, security requirements, escalation procedures, and service-level commitments.
• Monitor SOC performance using operational metrics such as alert volume, investigation and response timelines, escalation trends, service-level agreement attainment, detection quality, false-positive rates, case quality, and analyst workload.
• Identify operational bottlenecks and drive measurable improvements through process refinement, detection tuning, automation, AI-assisted workflows, analyst enablement, and improved technology integration.
• Ensure SOC playbooks, runbooks, standard operating procedures, escalation paths, and investigative standards are documented, maintained, consistently followed, and continuously improved.
• Coordinate operational response to cybersecurity incidents and review complex investigations to ensure appropriate scope, technical accuracy, escalation, containment recommendations, documentation, customer communication, and transition to dedicated Incident Response resources when required.
• Maintain working knowledge of SIEM, EDR/XDR, SOAR, NDR, cloud security, identity security, email security, threat intelligence, case management, and security analytics technologies used across customer environments.
• Ensure SOC personnel can effectively investigate activity across endpoint, identity, network, email, cloud, SaaS, and hybrid environments.
• Partner with Detection Engineering, Cyber Threat Intelligence, Threat Hunting, Incident Response, Red Team, Security Engineering, and SOAR/Automation teams to improve detection coverage, alert fidelity, investigation workflows, and response capabilities.
• Drive an intelligence-informed approach to security operations by incorporating emerging threats, adversary tactics, techniques, and procedures, MITRE ATT&CK, incident lessons learned, threat hunting results, and analyst feedback into detection, investigation, and operational priorities.
• Support the responsible adoption of AI-assisted security operations capabilities for alert triage, investigation, enrichment, summarization, workflow automation, and analyst decision support while maintaining appropriate human oversight and accountability.
• Support new customer onboarding and operational readiness, including processes, escalation paths, telemetry availability, detection readiness, reporting requirements, and analyst enablement.
• Build effective working relationships with customer security teams, IT teams, technical stakeholders, and leadership. Participate in customer operational reviews, incident calls, service reviews, and escalations as required.
• Develop and present operational reporting, dashboards, incident summaries, service metrics, risks, trends, and improvement recommendations to technical and leadership audiences.
• Participate in an after-hours management and incident escalation rotation as required to support 24x7x365 operations.
• Perform other duties as assigned.

Required Skills

• 8+ years of cybersecurity experience, with significant experience in Security Operations, Incident Response, Threat Detection, Threat Hunting, Detection Engineering, Cyber Threat Intelligence, or related cyber defense functions.
• Prior people-management experience within a SOC, MDR, MSSP, or comparable cyber defense environment, including responsibility for coaching, performance management, skills development, staffing, and operational accountability.
• Strong understanding of modern security operations and incident investigation across endpoint, identity, network, email, cloud, SaaS, and hybrid environments.
• Experience working with enterprise SIEM and EDR/XDR technologies, such as Microsoft Sentinel, Splunk, Elastic Security, Microsoft Defender XDR, CrowdStrike Falcon, Trellix, SentinelOne, or equivalent platforms.
• Experience with SOAR, security automation, case management, or AI-assisted security operations technologies.
• Experience investigating security activity involving Microsoft 365, Microsoft Entra ID, Azure, AWS, cloud workloads, SaaS applications, or other cloud and identity environments.
• Strong understanding of contemporary attacker methodologies and attack lifecycles, including threat actor tactics, techniques, and procedures, identity-based attacks, ransomware, account compromise, business email compromise, cloud attacks, and other modern threats.
• Experience applying MITRE ATT&CK to security operations, including investigations, detections, threat hunting, or measurement of defensive coverage.
• Demonstrated ability to lead operational response during cybersecurity incidents and coordinate activities across technical teams, customers, and organizational stakeholders.
• Experience developing, implementing, or improving SOC processes, playbooks, runbooks, escalation procedures, and investigative standards.
• Strong understanding of SOC performance measurement, including investigation quality, SLA performance, response timelines, detection effectiveness, alert fidelity, workload, and escalation trends.
• Excellent written and verbal communication skills with demonstrated ability to communicate complex cybersecurity issues to analysts, engineers, customers, executives, and non-technical stakeholders.
• Strong problem-solving, judgment, and decision-making skills, particularly during ambiguous, time-sensitive, or high-impact security events.
• Demonstrated ability to independently manage competing personnel, customer, incident, and operational priorities while maintaining accountability for service delivery and outcomes.
• S. Citizenship and ability to obtain and maintain a Secret security clearance.
• Ability to travel periodically to ECS or customer locations as business requirements dictate.

Desired Skills

• Experience leading security operations within a multi-tenant MSSP or MDR environment supporting multiple customer environments.
• Experience with one or more major security ecosystems, including Microsoft Sentinel and Defender XDR, CrowdStrike Falcon, Elastic Security, Splunk, Trellix, SentinelOne, or equivalent enterprise security platforms.
• Experience implementing or managing SOAR, security automation, APIs, scripting, or AI-assisted security workflows, including appropriate validation, human review, and oversight mechanisms.
• Familiarity with detection engineering concepts and technologies such as KQL, SPL, Sigma, Elastic Query Language, detection-as-code, detection validation, and alert tuning. Deep detection-development expertise is not required, but candidates should be capable of evaluating detection quality and working effectively with Detection Engineering personnel.
• Experience supporting threat hunting, purple-team exercises, adversary emulation, or similar activities used to identify and validate detection and response capabilities.
• Knowledge of applicable cybersecurity frameworks and standards such as NIST Cybersecurity Framework, NIST SP 800-61, MITRE ATT&CK, CMMC, FedRAMP, HIPAA, PCI DSS, or SOC 2.
• Experience with customer onboarding, operational readiness, service transitions, and continuous improvement within managed cybersecurity services.
• Advanced cybersecurity or security leadership certifications such as CISSP, CISM, GSLC, GSOM, GCIH, GCIA, SC-100, SC-200, or equivalent certifications.

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth , a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

Meet the challenge. Make a difference with Everforth ECS!

Our Company

Our Culture

EEO is the Law

ADP Privacy Statement Artificial Intelligence Google Privacy Policy Google Terms of Service