Cybersecurity Operations Manager

Responsibilities

• the Manager leads day-to-day delivery of managed security services while remaining directly involved in detection, investigation, and incident response.
• The position sits between security strategy, owned by the vCISO, and execution, carried out by the SOC team.
• The Manager is accountable for the security posture and incident outcomes our clients experience, with a role that is outcome-driven, focused on reducing client risk, improving response times, and being the dependable last line of decision-making when a security event escalates.

Security Leadership and Escalation

• Serve as the final escalation point for security alerts and incidents across all managed clients.
• Lead and develop the Cybersecurity Operations team with direct, hands-on coaching and clear accountability.
• Establish roles, expectations, KPIs, and escalation paths for the SOC team.
• Own queue health across all managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for the outcome.
• Work the security queue directly when volume exceeds team capacity or when SOC team members are on PTO, out, or otherwise unavailable – queue coverage is an expected part of this working leadership role, not an exception.

SOC and Incident Response

• Oversee daily SOC operations, including monitoring, alert triage, and response.
• Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when an incident requires it.
• Improve detection logic, alert quality, and response workflows on an ongoing basis.
• Manage MDR and SIEM partner relationships and hold them to service expectations.

Client Security Accountability

• Own the security outcomes managed clients experience: detection quality, response speed, containment, and client confidence.
• Serve as the senior technical voice in client-facing security conversations covering incidents, posture, reporting, and remediation.
• Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements.

Operational Excellence

• Develop and maintain runbooks, playbooks, and standard operating procedures.
• Track performance against response times, detection accuracy, and SLA adherence, and act on trends to reduce noise and improve efficiency.
• Partner with Advanced Services on detection engineering, automation, and tooling – including EDR/XDR, log and SIEM ingestion, identity protection, and email security – rather than maintaining a separate engineering function.

This is a hands-on leadership role

About Scarlett Group....

Scarlett Group is recognized as a JBJ Best Places to Work and is one of the fastest-growing technology companies in the region. We offer competitive benefits, opportunities for advancement, professional development support, and a culture built on collaboration, accountability, and having fun while doing meaningful work. Great benefits. Great people. Great opportunities. That's the Scarlett difference.

Your work as a Cybersecurity Operations Manager will include several components:

Cross-Functional Collaboration

Coordinate security-related work with Support, NOC, and Professional Services.

Ensure clean escalation and resolution across operational teams.

Contribute to company-wide automation, AI, and service delivery initiatives.

Our ideal Cybersecurity Operations Manager has the following qualifications:

4 to 6 years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents.

2 or more years in a leadership role, formal or informal, including mentoring or directing other analysts.

MSP, MSSP, or multi-client environment strongly preferred.

Strong working knowledge of endpoint detection and response (EDR/XDR), SIEM and log management, identity and access management (Entra, Conditional Access), and email security.

Comfort serving as the final technical decision-maker under pressure during active incidents.

Familiarity with security frameworks (NIST, CIS, ISO) and compliance-driven environments; CMMC and NIST 800-171 experience is a plus.

Strong coaching, team development, and performance management capabilities.

Excellent communication, including translating technical issues for business stakeholders.

Sound problem-solving and decision-making under pressure.

Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience.

Preferred: Security+, CySA+, GCIH, or equivalent; CISSP, GCFA, or other advanced certifications are a plus but not expected.

This role will operate on a hybrid basis out of Jacksonville, FL and will host a base compensation of $90,000-$100,000.

We are seeking candidates who thrive as the dependable last line of decision-making when a security event escalates. If you are a hands-on security leader who wants ownership over both the SOC's day-to-day execution and its long-term outcomes, we would welcome the opportunity to speak with you.