SOC Manager (Cybersecurity)

Join our team as a SOC Manager (Cybersecurity) and take the lead in building and managing our Security Operations Center. You will define the operating model, hire and train analysts, write and maintain playbooks, and own the SOC budget and vendor relationships. You will also be responsible for detecting and responding to security incidents, protecting sensitive data, and producing evidence for compliance assessments. This is a critical role in ensuring the security of our organization and its data.

• Construire et diriger le SOC, définir le modèle opérationnel et gérer le budget.
• Détecter et répondre aux incidents de sécurité, diriger les enquêtes et coordonner avec les parties prenantes.
• Produire des preuves pour les évaluations CMMC et NIST, et rapporter les performances du SOC à la direction.

• 8+ years in security operations, incident response or threat hunting, including 4-5+ years leading a SOC or IR team
• Experience in a regulated defense, aerospace or federal environment that handles CUI or export-controlled data
• Bachelor's degree in a technical field, or equivalent experience. We weigh experience heavily
• Hands-on depth with SIEM, EDR and SOAR platforms: you can write a detection, read a packet capture and pull a forensic timeline
• Scripting ability in Python, PowerShell or a comparable language, and fluency in at least one SIEM query language
• Clear writing. Your incident reports will be read by executives, counsel, assessors and government customers
• Experience operating security tooling in a government community cloud or similarly restricted tenant
• Working knowledge of NIST SP 800-171, CMMC Level 2, DFARS 252.204-7012 and NIST SP 800-61 incident handling
• A record of leading significant incidents end to end, including executive communication and external reporting
• Experience managing an MSSP or MDR provider against measurable service levels
• Experience monitoring lab, manufacturing or embedded environments alongside enterprise IT
• Experience building a SOC from an early stage at a fast-growing hardware or defense technology company
• Experience supporting a C3PAO assessment or DIBCAC review as the owner of incident response and audit evidence
• Insider threat program experience, including work with counterintelligence or DCSA
• Familiarity with NISPOM (32 CFR Part 117) and the boundary between unclassified security operations and classified system monitoring
• Certifications such as GCIH, GCFA, GCIA, GCDA, GNFA or CISSP
• Prior military, intelligence community or DoD cyber operations experience