SOC Project Manager – SOC Lead (Secret Clearance)

ShorePoint, LLC; Washington (District of Columbia); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

PTO 144 hours

11 holidays

85% insurance premium coverage

401(k)

Continuing education

Certification maintenance & reimburse

Job summary

ShorePoint, LLC is seeking a SOC Project Manager – SOC Lead (Secret Clearance) to direct a 24x7 SOC for unclassified environments. You will coordinate cross-team efforts, manage on-premises and cloud SOC capabilities, and report to executives on performance and posture.

Candidate must have 10+ years in SOC operations and incident response for large enterprises, a Secret clearance, and hands-on Splunk ES experience. This onsite role is based in Washington, DC.

Qualifications

• Bachelor’s degree or 3+ years of related experience in lieu of degree.
• 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints).
• Active Security Clearance at Secret level required.
• Experience leading hybrid on-premises/cloud SOCs with full NIST CSF coverage.
• Ability to influence executive leadership and drive SOC adoption.
• Hands-on with Splunk ES and major EDR platforms (Trellix/FireEye HX, Microsoft Defender).
• Familiarity with ServiceNow incident management and network/threat tools.

Responsibilities

• Lead a 24x7 SOC for unclassified environments with shift coverage.
• Coordinate task execution across sub-task leads to meet enterprise goals.
• Oversee on-premises and cloud-based SOC capabilities integration.
• Communicate SOC performance to executives and stakeholders.
• Ensure full NIST CSF coverage across Identify, Protect, Detect, Respond, Recover.
• Direct incident coordination, playbooks, and lifecycle documentation.
• Produce reporting to federal oversight bodies and agencies.

Skills

SOC leadership

Incident response

Executive liaison

24x7 operations management

NIST CSF

Security operations

Hybrid on-prem/cloud

AI-enabled analytics

Education

Bachelor’s degree

Tools

Splunk ES

Trellix/FireEye HX

Microsoft Defender

ServiceNow

Snort/Zeek

MISP

STIX/TAXII

Tenable

Qualys

Job description

Who We Are

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a “work hard, play hard” mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.

The Perks

As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual’s technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more.

Who We’re Looking For

We are seeking a SOC Project Manager – SOC Lead (Secret Clearance) to lead and manage all Security Operations Center functions. The SOC Lead will ensure unified service delivery across sub-task areas, provide operational direction and influence executive leadership to align security operations with enterprise objectives. The SOC Project Manager – SOC Lead role requires deep expertise in SOC management, incident response and hybrid on-premises/cloud environments. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

What You’ll Be Doing

• Lead a 24x7x365 SOC for unclassified environments. Ensure shift managers and escalation contacts cover every shift and on-call support is available for incident response.
• Coordinate task execution across sub-task leads to achieve enterprise-level objectives.
• Oversee the integration and coordination of on-premises and cloud-based SOC capabilities.
• Communicate effectively with executive leadership and stakeholders on SOC performance and posture.
• Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond and Recover.
• Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.
• Serve as, or direct, the Incident Commander for significant and widespread incidents. Responsibilities include:
  • leading incident calls
  • coordinating response across all teams and task orders
  • managing government notifications and stakeholder communications
  • tracking after-action items through remediation
• Direct the task order incident coordinators within each sub-task area. Ensure playbook adherence and full incident lifecycle documentation in the ticketing system.
• Oversee required reporting to federal oversight bodies, the Inspector General and law enforcement. Oversee reporting of classified spills onto unclassified systems.
• Coordinate with interagency and intelligence community partners such as CISA, the FBI and DHS.
• Execute the operational side of SOC consolidation:
  • onboarding new customer organizations’ log sources and alerting
  • standardizing detection logic, escalation protocols and playbooks
  • transitioning onboarded organizations into steady-state operations and maintenance
• Develop and maintain SOPs, incident response playbooks, an alert severity and triage framework, and standardized reporting templates.
• Own SOC performance metrics: mean time to detect, mean time to respond, alert volumes, false positive rates, ticket closure rates and SLA compliance. Explain any deviations and propose corrective actions.
• Build a centralized incident knowledge base and lessons-learned repository that is shared across customer organizations.
• Lead adoption of AI-enabled analytics and next-generation security automation.
• Train SOC staff on operating procedures and ensure analysts maintain tool proficiency.

What You Need To Know

• Strong background in cybersecurity incident response across large, complex enterprise environments.
• Proven ability to align SOC functions with the NIST Cybersecurity Framework.
• Experience coordinating subordinate managers and technical leads to deliver cohesive operations.
• Skilled at influencing executive leadership and driving organizational adoption of SOC best practices
• Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.
• Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII) and vulnerability tools (Tenable, Qualys).
• Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention and escalation structures.
• Familiarity with federal incident reporting requirements and OMB M-21-31 event logging maturity.

Must Have’s

• Bachelor’s degree or 3+ additional years of relevant experience in lieu of degree.
• 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints), including 5+ years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.
• Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
• Applicants must hold and maintain an active Secret clearance.

Beneficial To Have The Following

• Hold one or more of the following active certifications: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Manager (GSOM), or Certified Information Security Manager (CISM).
• Experience integrating multiple organizations into a consolidated SOC.

Where It’s Done

• Onsite (Washington, DC).