Cyber Security SOC Manager

About the role

This role serves as the technical driver of the SOC's day-to-day operations and detection posture, architecting how the operation detects, responds, and improves. It partners with the Operations Manager on the SOC's broader strategic direction, bringing the technical and architectural point of view to that partnership.

Responsibilities

• Serve as senior escalation authority for complex, high-severity incidents; oversee containment and remediation, and ensure documentation and customer communication throughout the incident lifecycle.
• Provide expertise with IOCs, TTPs, threat hunting, and threat intelligence; own customer-facing escalation and remediation.
• Ensure the team recognizes intrusion attempts and triages, prioritizes, and escalates incidents per established runbooks.
• Ensure detection of the full spectrum of known attacks (DDoS, malware, phishing, ransomware, and others) and correlation of events across capabilities.
• Ensure malware analysis is reviewed and correlated across incidents, and that malicious activity is documented and reported with clear remediation recommendations.
• Set the standards, priorities, and design for Splunk dashboards, reports, correlation searches, and alert actions that give analysts and leadership visibility into threat activity, SOC performance, and incident trends.
• Oversee SPL searches, scheduled reports, and lookup-driven workflows; guide scripting (Python, PowerShell) that extends Splunk and supports automation.
• Align detections and logging with frameworks and controls: NIST 800-53, NIST CSF, PCI DSS, HIPAA, and SOX as applicable to the customer environment.
• Define the target-state SOC architecture — detection pipeline, data model, and automation fabric — and set the engineering standards the Tier III analyst executes against.
• Drive improvement by design: higher detection fidelity and performance, cleaner reporting, fewer manual errors, lower tooling and compute cost, and a stronger security posture.
• Evaluate and prototype new capabilities before production; make build-vs-buy and integrate-vs-replace calls grounded in hands-on assessment.
• Lead, supervise, and develop the Tier I–III team; manage shift scheduling, performance expectations, and career development.
• Own SOC SLA compliance and performance reporting; deliver operational metrics, trend analysis, and executive briefings to program leadership and the customer.
• Manage expectations, communicate incident status, and build trusted relationships with VITA stakeholders.
• Drive continuous improvement across processes, runbooks, and playbooks; run post-incident retrospectives and apply lessons learned.

Requirements

• Education: BA/BS or equivalent.
• Experience: 5+ years of experience required in cybersecurity operations, including demonstrated supervisory or team-lead experience in a SOC environment. 8+ years of experience strongly preferred.
• Splunk: Advanced SPL, dashboard development, automated alerting, and correlation-search creation in an operational SOC.
• Tenable and CrowdStrike: Native data experience and interpretation skills, correlation with other data, and understanding of the integration with Splunk data and dashboards.
• Must possess or be able to obtain within six months of start two of the following certifications to meet DoD 8140/DCWF CSSP Analyst requirements: CEH, CFR, CCNA Cyber Ops, CCNA-Security, CySA+, GCIA, GCIH, GICSP, Cloud+, SCYBER, or PenTest+

Qualifications

• Must be able to pass a background check to obtain a position of Public Trust.

Skills

• Information Security Operations
• IT Leadership
• Security Monitoring Operations
• Security Operations
• Splunk Administration

Benefits

Comprehensive benefits and wellness packages, 401(k) with company match, and competitive pay and paid time off.

Pay

$136,000 - $184,000

Schedule

Full-time