SOC Manager

Synergy Business Consulting, Inc.; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Synergy Business Consulting, Inc. is seeking an experienced Security Operations Center (SOC) Manager to lead a 24x7 security operation across multiple client environments.

This hands-on role combines leadership with direct engagement in monitoring, threat detection, incident response, and continuous improvement. You will mentor SOC supervisors and analysts, develop playbooks, manage on-call rotations, and report to senior leadership.

Qualifications

• 7+ years in cybersecurity or security operations.
• 3+ years in SOC leadership or management.
• Experience in MSSP/MSP/MDR environments.
• Ability to develop incident-response playbooks and runbooks.
• Strong client-facing communication skills.

Responsibilities

• Lead 24x7 SOC operations ensuring timely detection, triage, investigation, escalation, and response.
• Develop escalation matrices, incident-response playbooks, SOPs, and runbooks.
• Manage and develop SOC Supervisors and Analysts across levels.
• Coordinate with clients and executive stakeholders for incident management and reporting.
• Oversee incident lifecycle and post-incident reviews; drive continuous improvement.

Skills

SOC leadership

Incident response

Security operations

Threat detection

Communication (written & verbal)

Education

Bachelor’s degree in Cybersecurity/IT/CS

Master’s degree preferred

Tools

Google Chronicle

CrowdStrike

KnowBe4

Microsoft Defender

Microsoft Sentinel

Splunk

ConnectWise Manage

MITRE ATT&CK

Job description

Eligible states: South Carolina, Georgia, Arkansas, Missouri, Oklahoma, Texas, and Tennessee.

About the Role

We are seeking an experienced, hands-on Security Operations Center (SOC) Manager to lead the strategic and day-to-day operations of a 24x7x365 managed security operation.

This role is responsible for ensuring effective security monitoring, threat detection, investigation, incident response, and continuous improvement across multiple client environments. The SOC Manager will lead SOC Supervisors, Level 1, Level 2, and Level 3 Analysts, and dispatchers while establishing the operational discipline, documented procedures, and escalation processes required to deliver consistent, high-quality security services.

This is a working management position, not a purely supervisory role. The ideal candidate is comfortable working directly with security tools, analyzing operational metrics, building reports, authoring playbooks, and improving detection and response processes.

The SOC Manager will serve as a key operational leader between client Service Delivery Managers and senior leadership, collaborating with security, network operations, professional services, governance and compliance teams, and external technology partners.

Key Responsibilities

SOC Operations & Leadership

• Lead daily operations of a 24x7x365 SOC, ensuring timely detection, triage, investigation, escalation, and response to security events.
• Manage and develop SOC Supervisors, L1/L2/L3 Analysts, and dispatchers.
• Establish and maintain escalation matrices, incident-response playbooks, SOPs, runbooks, and operational standards.
• Ensure SOC services meet client SLAs, contractual obligations, and internal security policies.
• Drive continuous improvement, operational consistency, and accountability across a multi-client environment.

Coverage, Shift Management & On-Call

• Establish documented on-call rotations for after-hours, weekend, and critical incident escalation.
• Implement structured shift-handoff procedures that capture open incidents, ongoing investigations, customer callbacks, and outstanding action items.
• Maintain effective overnight and dispatcher coverage with documented response procedures.
• Ensure consistent communication and escalation across internal teams and external delivery partners.
• Oversee the full incident lifecycle, including detection, triage, investigation, containment coordination, and post-incident review.
• Serve as the senior SOC escalation point for high-severity incidents, coordinating with clients, network operations, professional services, and executive or legal stakeholders as appropriate.
• Work with security technologies including:
• Google Chronicle / Google SecOps
• CrowdStrike
• KnowBe4
• Coordinate SOC-to-NOC handoffs for infrastructure containment and ensure clear ownership of response actions.
• Support major-incident response teams with validated indicators of compromise, investigation findings, and technical evidence.
• Track contractual breach-notification requirements and elevate legal determinations to the appropriate counsel.
• Manage operational relationships with managed-SIEM, MDR, and co-delivery partners.
• Participate in partner reviews and maintain scorecards covering security coverage, escalations, SLA performance, and operational misses.
• Evaluate the effectiveness of detection and response tools and recommend improvements to the security operations stack.
• Ensure partner handoffs, shift coverage, and escalation procedures meet operational expectations.

Detection Engineering & MITRE ATT&CK Coverage

• Develop and maintain a validated MITRE ATT&CK coverage baseline across security tools, customer environments, and ingested log sources.
• Identify, prioritize, and track gaps in detection coverage.
• Maintain a detection-tuning and false-positive backlog to improve alert quality and reduce unnecessary escalations.
• Collaborate with detection-engineering teams on SIEM parsing, data normalization, use-case development, and detection scoring.
• Use measurable coverage and tuning outcomes to improve threat detection rather than relying on alert suppression.

SLAs, Metrics & Reporting

• Define and monitor outcome-based SLAs and service-level objectives.
• Track and report key performance indicators, including:
• Mean Time to Acknowledge (MTTA)
• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Detection coverage and alert quality
• Incident volume, severity, and response performance
• Lead monthly customer service reviews and quarterly business reviews.
• Produce clear operational dashboards, coverage assessments, risk reports, and executive-level recommendations.
• Accurately communicate performance, risks, limitations, and known detection gaps.
• Coach, mentor, and develop SOC personnel across all analyst levels.
• Conduct performance reviews and establish training and certification development plans.
• Build a clear progression path from L1 to L2 to L3, strengthening technical capabilities and senior escalation coverage.
• Promote consistent investigation practices, documentation standards, and professional development.

Compliance & Stakeholder Engagement

• Align SOC operations with applicable cybersecurity frameworks and regulatory requirements, including NIST, ISO 27001, CIS, MITRE ATT&CK, HIPAA, PCI-DSS, and GLBA.
• Serve as a primary SOC contact for client stakeholders and senior leadership.
• Communicate complex technical issues clearly to analysts, engineers, clients, and executive audiences.
• Maintain accurate service, project, and activity records within the designated PSA and ticketing platform.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field; a master’s degree is preferred.
• 7+ years of cybersecurity or security operations experience, including at least 3 years in SOC leadership or management.
• Demonstrated experience managing SOC teams and directing high-severity incident response.
• Experience in an MSSP, MSP, MDR, or other multi-client security operations environment.
• Strong understanding of 24x7 SOC coverage, incident escalation, operational metrics, client SLAs, and shift management.
• Experience developing and maintaining incident-response playbooks, SOPs, runbooks, and escalation procedures.
• Ability to work independently, identify operational weaknesses, and implement measurable improvements.
• Strong written and verbal communication skills, including client-facing communication and executive reporting.
• Must reside in one of the eligible states listed above.

Technical Skills

• EDR/MDR: Huntress, CrowdStrike, Microsoft Defender, or comparable platforms.
• SIEM/SOAR: Google Chronicle / Google SecOps, Microsoft Sentinel, Splunk, or comparable technologies.
• ITSM/PSA: Experience with ticketing-driven incident management and escalation; ConnectWise Manage experience is a strong plus.
• Strong knowledge of incident management, threat intelligence, forensic fundamentals, vulnerability management, and detection tuning.
• Working knowledge of MITRE ATT&CK for detection coverage design and validation.
• Understanding of cybersecurity frameworks and regulatory requirements, including NIST, ISO 27001, HIPAA, PCI-DSS, and GLBA.
• Proficiency with Microsoft Office and the ability to develop operational reports, recommendations, and presentations.

Certifications

• CISSP or CISM: Required or strongly preferred.
• CISA or CRISC: Strongly preferred.
• GCIH, GCIA, GIAC, or CEH: Preferred.
• CompTIA Security+ or CySA+: Baseline certification expected.
• ITIL Foundation or Lean Six Sigma: A plus.

Ideal Candidate

The successful candidate is a technically capable security operations leader who can balance strategic planning with hands-on execution. They demonstrate sound judgment during high-severity incidents, build strong teams, communicate effectively with clients and executives, and continuously improve SOC performance in a demanding, multi-client environment.

They should be comfortable planning 6-12 months ahead while translating strategic objectives into documented processes, measurable improvements, and reliable day-to-day operations.