SOC Manager (Cybersecurity)

Join our team as a SOC Manager (Cybersecurity) and take the lead in building and managing our Security Operations Center. You will define the operating model, hire and train analysts, write and maintain playbooks, and own the SOC budget and vendor relationships. You will also be responsible for detecting and responding to security incidents, protecting sensitive data, and producing evidence for compliance assessments. This is a critical role in ensuring the security of our organization and its data.

Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012 and NIST SP 800-61 incident handling

Responsibilities

• Construire et diriger le SOC, définir le modèle opérationnel et gérer le budget.
• Détecter et répondre aux incidents de sécurité, diriger les enquêtes et coordonner avec les parties prenantes.
• Produire des preuves pour les évaluations CMMC et NIST, et rapporter les performances du SOC à la direction.
• 8+ years in security operations, incident response or threat hunting, including 4-5+ years leading a SOC or IR team
• Experience operating security tooling in a government community cloud or similarly restricted tenant
• A record of leading significant incidents end to end, including executive communication and external reporting
• Experience managing an MSSP or MDR provider against measurable service levels
• Experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence

Requirements

• Experience in a regulated defense, aerospace or federal environment that handles CUI or export-controlled data
• Bachelor's degree in a technical field, or equivalent experience. We weigh experience heavily
• Hands-on depth with SIEM, EDR and SOAR platforms: you can write a detection, read a packet capture and pull a forensic timeline
• Scripting ability in Python, PowerShell or a comparable language, and fluency in at least one SIEM query language
• Clear writing. Your incident reports will be read by executives, counsel, assessors and government customers
• Experience monitoring lab, manufacturing or embedded environments alongside enterprise IT
• Experience building a SOC from an early stage at a fast-growing hardware or defense technology company
• Insider threat program experience, including work with counterintelligence or DCSA
• Familiarity with NISPOM (32 CFR Part 117) and the boundary between unclassified security operations and classified system monitoring

Preferred

• Certifications such as GCIH, GCFA, GCIA, GCDA, GNFA or CISSP
• Prior military, intelligence community or DoD cyber operations experience

Pay

USD 180,000 - 240,000