SOC Operations Lead / Managed Detection & Response (MDR) Lead

The SOC Operations Lead will oversee 24x7x365 Security Operations Center (SOC) and Managed Detection & Response (MDR) operations supporting a large federal enterprise environment. The Lead will direct SOC analysts, incident responders, and MDR personnel responsible for security monitoring, alert triage, incident analysis, escalation, containment coordination, reporting, and continuous operational improvement. The ideal candidate possesses deep experience leading enterprise SOC operations supporting federal agencies, including SIEM operations, endpoint detection and response (EDR), cloud security monitoring, incident coordination, and executive cyber reporting., * Lead enterprise SOC and MDR operations supporting on-premises and cloud environments.

• Oversee 24x7 monitoring, detection, triage, and escalation activities.
• Direct operational workflows for:

• SIEM monitoring,
• alert management,
• incident coordination,
• case management,
• and operational reporting.

• Manage analyst teams supporting:

• Splunk,
• Microsoft Sentinel,
• CrowdStrike,
• Sysmon,
• Windows event logging,
• and cloud telemetry platforms.

• Develop and maintain SOC SOPs, playbooks, runbooks, escalation matrices, and reporting procedures.
• Lead operational metrics reporting including:

• MTTD,
• MTTR,
• false positive rates,
• automation effectiveness,
• analyst productivity,
• and incident impact assessments.

• Coordinate closely with Threat Hunting, CTI, Detection Engineering, and Incident Response teams.
• Brief executives and government leadership on significant incidents, operational trends, and emerging threats.
• Support proposal development, oral presentations, staffing, and transition planning.

• 10+ years of cybersecurity operations experience.
• 5+ years leading enterprise SOC or MDR environments.
• Experience supporting federal civilian or DoD environments.
• Experience managing large-scale SOC operations in environments exceeding:

• 10,000+ users,
• enterprise cloud environments,
• and large SIEM deployments.

• Experience with:

• Splunk Enterprise Security,
• Microsoft Sentinel,
• CrowdStrike,
• EDR/XDR platforms,
• SOAR technologies,
• and cloud security monitoring.

• Deep understanding of:

• MITRE ATT&CK,
• incident response,
• detection engineering,
• and threat-informed defense.

• Strong executive briefing and oral presentation skills.

Preferred Certifications

• CISSP
• GCIA
• GCIH
• GMON
• GSOC
• Splunk Architect/Admin certifications
• Microsoft Security certifications

Invitation for Job Applicants to Self-Identify as a U.S. Veteran

• A "disabled veteran" is one of the following:

• a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or
• a person who was discharged or released from active duty because of a service-connected disability.

• A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.
• An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.
• An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.