SOC Project Manager – SOC Lead (Secret Clearance) with Security Clearance

ShorePoint, LLC; Washington (District of Columbia); On-site; USD 190,000 - 230,000; Full time

Benefits offered by this job

PTO 144 hours

11 holidays

85% health insurance premiums covered

401(k)

Education & certification maintenance

Job summary

ShorePoint, LLC is seeking a SOC Project Manager – SOC Lead (Secret Clearance) to direct a 24x7 SOC for high-profile, sensitive environments. You will ensure unified service delivery, coordinate across sub-teams, and lead incident response in both on-premises and cloud environments.

The role demands deep SOC management expertise, experience with federal incident reporting, and a track record of aligning SOC operations with the NIST Cybersecurity Framework.

Qualifications

• Bachelor’s degree or 3+ years of relevant experience in lieu of degree.
• 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints).
• 5+ years leading hybrid on-premises/cloud SOCs with full NIST coverage.
• Active Secret clearance required.

Responsibilities

• Lead a 24x7x365 SOC for unclassified environments.
• Coordinate task execution across sub-task leads to achieve enterprise objectives.
• Oversee on-premises and cloud-based SOC capabilities integration and coordination.
• Communicate SOC performance and posture to executive leadership.
• Ensure SOC operations follow the NIST Cybersecurity Framework across Identify, Protect, Detect, Respond, Recover.
• Manage coverage commitments for customer offices and shift scheduling.
• Lead incident calls and coordinate responses across teams and tasks.
• Oversee government notifications and stakeholder communications.
• Maintain incident lifecycle documentation and reporting to oversight bodies.

Skills

SOC leadership

Incident response

NIST CSF

Executive communication

AI-enabled analytics

Security operations

Team coordination

Cybersecurity incident response

Education

Bachelor’s degree

3+ years experience in lieu of degree

Tools

Splunk

Splunk ES

Trellix/FireEye HX

Microsoft Defender

ServiceNow

Snort/Zeek

Tenable

Qualys

Job description

Who we are: ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a “work hard, play hard” mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.

The Perks: As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual’s technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more.

Who we’re looking for: We are seeking a SOC Project Manager – SOC Lead (Secret Clearance) to lead and manage all Security Operations Center functions. The SOC Lead will ensure unified service delivery across sub-task areas, provide operational direction and influence executive leadership to align security operations with enterprise objectives. The SOC Project Manager – SOC Lead role requires deep expertise in SOC management, incident response and hybrid on-premises/cloud environments. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

What you’ll be doing:

• Lead a 24x7x365 SOC for unclassified environments. Ensure shift managers and escalation contacts cover every shift and on-call support is available for incident response.
• Coordinate task execution across sub-task leads to achieve enterprise-level objectives.
• Oversee the integration and coordination of on-premises and cloud-based SOC capabilities.
• Communicate effectively with executive leadership and stakeholders on SOC performance and posture.
• Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond and Recover.
• Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.
• Serve as, or direct, the Incident Commander for significant and widespread incidents. Responsibilities include:
• Lead incident calls.
• Coordinate response across all teams and task orders.
• Manage government notifications and stakeholder communications.
• Track after-action items through remediation.
• Direct the task order incident coordinators within each sub-task area. Ensure playbook adherence and full incident lifecycle documentation in the ticketing system.
• Oversee required reporting to federal oversight bodies, the Inspector General and law enforcement. Oversee reporting of classified spills onto unclassified systems.
• Coordinate with interagency and intelligence community partners such as CISA, the FBI and DHS.
• Execute the operational side of SOC consolidation:
• Onboarding new customer organizations’ log sources and alerting.
• Standardizing detection logic, escalation protocols and playbooks.
• Transitioning onboarded organizations into steady-state operations and maintenance.
• Develop and maintain SOPs, incident response playbooks, an alert severity and triage framework, and standardized reporting templates.
• Own SOC performance metrics: mean time to detect, mean time to respond, alert volumes, false positive rates, ticket closure rates and SLA compliance. Explain any deviations and propose corrective actions.
• Build a centralized incident knowledge base and lessons-learned repository that is shared across customer organizations.
• Lead adoption of AI-enabled analytics and next-generation security automation. What you need to know:
• Strong background in cybersecurity incident response across large, complex enterprise environments.
• Proven ability to align SOC functions with the NIST Cybersecurity Framework.
• Experience coordinating subordinate managers and technical leads to deliver cohesive operations.
• Skilled at influencing executive leadership and driving organizational adoption of SOC best practices
• Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.
• Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII) and vulnerability tools (Tenable, Qualys).
• Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention and escalation structures.
• Familiarity with federal incident reporting requirements and OMB M-21-31 event logging maturity. Must have’s:
• Bachelor’s degree or 3+ additional years of relevant experience in lieu of degree.
• 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints), including 5+ years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.
• Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
• Applicants must hold and maintain an active Secret clearance. Beneficial to have the following:
• Hold one or more of the following active certifications: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Manager (GSOM), or Certified Information Security Manager (CISM).
• Experience integrating multiple organizations into a consolidated SOC. Where it’s done:
• Onsite (Washington, DC).