USAF - SOC Lead

cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications

• Active TS/SCI clearance B.S.
• Computer Science, Information Technology, or a related field Experience leading SOC personnel or comparable defensive cybersecurity operations.
• Experience directing alert triage, threat hunting, investigations, and incident response.
• Ability to manage operational priorities, analyst development, coverage, and handoffs.
• Knowledge of networks, endpoints, cloud environments, logs, and common cyberattack techniques.
• Experience with security monitoring, endpoint detection, vulnerability tools, and detection tuning.
• Ability to coordinate remediation and response across operations, engineering, and cybersecurity teams.
• Understanding of evidence handling, secure configurations, compliance records, and operational risk.

Strong judgment and communication skills for timely Government reporting and incident coordination Duties:

• Lead SOC analysts and assigned response personnel; prioritize work, coach staff, review investigations, and maintain clear accountability for operational actions.
• Plan assigned staffing, coverage, on-call rotations, and handoffs to support required on-site and global response capabilities.
• Support SOC stand-up planning, tool configuration, sensor integration with command and control (C2) nodes, and enterprise scanning readiness.
• Coordinate centralized defensive operations, including monitoring, penetration testing support, threat hunting, cyber orders and taskers, and incident response.
• Oversee alert triage and analysis of security events and trends; validate findings, assess mission impact, and direct approved mitigation actions.
• Lead data and intelligence-driven threat hunting and anomaly investigations across DC3 information technology (IT) and operational technology (OT) environments.
• Direct incident detection, investigation, escalation, and approved containment, eradication, and recovery; keep Government stakeholders informed under established procedures.
• Review investigation evidence, incident timelines, and reports for accuracy and completeness; ensure response actions and handoffs are documented.
• Coordinate weekly vulnerability assessments with certified specialists; prioritize findings and track remediation with infrastructure, application, and cybersecurity teams.
• Maintain effective C2 coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities.
• Manage assigned cyber orders and taskers, coordinate implementation, and support required compliance documentation and Plans of Action and Milestones (POA&Ms).
• Assess SOC tools, telemetry coverage, and resource needs; recommend procurement and operational improvements through approved Government processes.
• Maintain incident response procedures, escalation guides, and operational documentation; incorporate lessons learned and submit required updates for Government approval.
• Coordinate with ISSOs and the ISSM to provide monitoring evidence and remediation status supporting RMF, authorization, and enterprise risk activities.
• Recommend improvements based on emerging threats, cybersecurity practices, and technologies, including benefits, risks, and implementation approaches.