SOC Team Lead

Revolutional; Memphis (TN); On-site; USD 120,000 - 160,000; Full time

Job summary

Revolutional in Memphis, TN is seeking a seasoned SOC Team Lead to oversee incident intake, coordination, and response within a 24x7 SOC for a large federal agency. You will lead SOC analysts, review reports, and drive timely escalation and resolution of cyber security incidents.

The role requires 7+ years of relevant experience, a Bachelor’s degree in a related field, and ability to obtain a Public Trust clearance.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field; 7+ years of relevant professional experience; 3 years may be substituted with additional experience.
• Seasoned technical contributor with broad knowledge and ability to develop solutions to difficult issues.
• Experience leading a SOC team or task lead, including assigning work and reporting status to client leadership.

Responsibilities

• Lead the team that receives and coordinates incoming incident reports.
• Coordinate incident handling across SOC functions and client sites.
• Maintain incident records and ensure timely escalation and closure.
• Collaborate with internal experts and partner SOCs, including CISA coordination.

Skills

SOC leadership

Incident coordination

NIST SP 800-61

SIEM & SOAR

CISA liaison

Education

Bachelor’s degree in Cybersecurity or related field

Tools

SIEM

SOAR

Job description

Location: Onsite – New Carrollton, MD or Memphis, TN

Terms: Full-time

Clearance: Public Trust

Travel: 0% (onsite presence at client facilities as directed)

Position Description

We are seeking a SOC Team Lead to serve as task lead for incident report acceptance and coordination in a 24x7x365 Security Operations Center (SOC) supporting a large federal agency. This seasoned technical contributor receives, reviews, documents, and coordinates reports of suspicious cyber activity and potential cybersecurity incidents from authorized sources, leads the analysts performing this work, and develops solutions to technical problems that may be difficult and unclear in collaboration with internal experts.

The successful candidate will:

• Lead the team that receives and coordinates incoming incident reports.
• Ensure every reported incident is accurately recorded, routed, and escalated on time.
• Keep incident records complete through closure.
• Coordinate incident handling across SOC functions and partner organizations.

Responsibilities:

• Serve as task lead for incident report acceptance and coordination, assigning and reviewing the work of SOC analysts.
• Receive, review, document, and coordinate reports of suspicious cyber activity or potential incidents from authorized sources, including internal personnel, organizational components, other contractors, third-party service providers, CISA, and partner SOCs.
• Monitor approved communication channels for incoming incident reports, suspicious activity reports, and situational awareness updates.
• Record, validate, and update incident information in approved tracking systems.
• Refer potential incidents to appropriate SOC personnel, client stakeholders, or other authorized parties for further review or action.
• Coordinate incident handling activities across relevant SOC functions under client direction.
• Maintain incident documentation, including actions taken, findings, timelines, and escalation history.
• Escalate incidents, issues, and required decisions to the client SOC team in accordance with established procedures.
• Support required incident reporting in accordance with organizational, contractual, and regulatory guidance.
• Verify that incident records contain sufficient information to support closure only after required remediation, coordination, and reporting have occurred.

Required Skills and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field and 7+ years of relevant professional experience; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• Seasoned technical individual contributor, fully proficient in applying technical principles, theories, and concepts in the field.
• Ability to develop solutions to technical problems and issues that are difficult, unclear, and require deep technical knowledge.
• Deep understanding of the principles, theories, and concepts of the technical domain, with broad understanding of related specialty areas.
• Experience with SOC incident intake, ticketing, and case management in a large enterprise.
• Working knowledge of NIST SP 800-61 and federal incident reporting requirements.
• Experience leading a team or serving as a task lead, including assigning work, reviewing quality, and reporting status to client leadership.
• Experience leading a team or serving as a task lead, including assigning work, reviewing quality, and reporting status to client leadership.
• Experience supporting federal government contracts as a contractor, including working to contract performance standards, deliverable schedules, and government review and approval processes.
• Certifications such as GCIH, CySA+, or CISSP.
• Experience with SIEM and SOAR platforms.
• Experience coordinating with CISA and partner SOCs.

Work Authorization/Clearance: Must be a U.S. Citizen and able to obtain a Public Trust clearance.