Security Operations Center (SOC) Manager

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We have job description with many details. Let's parse. We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. Also remove lines like "#EverforthECS1" maybe. We need to preserve all substantive information. We need sections: maybe "About the role" (intro), "Responsibilities", "Requirements" (maybe combine required skills?), "Qualifications" (maybe education/clearance?), "Skills" (desired skills?), "Benefits", "Pay" (salary), "Schedule" (hybrid remote/on-site). We need to ensure we only include sections if content present. Let's extract content. Job description starts: "Everforth ECS is seeking a Security Operations Center (SOC) Manager to work in our Fairfax, VA office in a hybrid remote/on-site capacity. Everforth ECS is seeking an experienced, outcome-driven Security Operations Center (SOC) Manager to work in our Fairfax, VA office in support of DoW environment U.S. Coalition Mission Partner Environments (MPE), each with a unique set of data and applications." We can combine into an "About the role" paragraph. Then responsibilities list: many bullet-like sentences. We'll put them in

• . Then requirements: includes U.S. citizen, Active DoW Secret or higher clearance, Bachelor's degree in STEM, Minimum DoD 8570 IAT Level II, Ability to work hybrid, 10+ years experience, etc. Also "Other duties, as assigned." maybe not needed. Qualifications: maybe overlapping with requirements; but we can treat "Required Skills" as qualifications? The posting has "Required Skills" heading then list. Also "Desired Skills" heading. We need to decide sections: Could have "Requirements" for mandatory items, "Preferred Qualifications" for desired skills. But the instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can map: - About the role: intro paragraph. - Responsibilities: list of primary responsibilities. - Requirements: mandatory requirements (citizenship, clearance, degree, certifications, experience, hybrid work ability). - Qualifications: maybe education? But we already used degree in requirements. Could put education under Qualifications. However we might combine. Better: Use Requirements for mandatory experience/clearance etc. Use Qualifications for education and certifications? But we have both. Alternatively, we could have Requirements (mandatory) and Skills (desired). But we also have "Required Skills" list which is basically mandatory skills. Could treat that as Requirements. Then Desired Skills as Skills (preferred). Benefits separate. Pay separate. Schedule separate. Let's extract: About the role: The two sentences about seeking SOC Manager, location Fairfax VA, hybrid remote/on-site, support DoW environment U.S. Coalition Mission Partner Environments (MPE), each with unique set of data and applications. We can combine. Responsibilities: list from "Primary Responsibilities" down to "Other duties, as assigned." We'll capture each bullet. Let's list them: - Build, deploy, and maintain a comprehensive SOC program leveraging best practices and compliant with client standards and requirements. - Oversee the Secure Unclassified Network (SUNet) SOC and coordinate all SOC activities including Tier support. - Serve as the primary incident commander for all SOC cybersecurity incidents. - Support the development of SOC plans, policies, and standard operating procedures (SOP). - Act as the primary SOC liaison with external agencies, mission partners, and third-party vendors during joint investigations and coordinated incident response efforts. - Represent SOC capabilities and readiness during stakeholder meetings, program reviews, and federal oversight briefings. - Integrate cyber threat intelligence (CTI) into SOC detection engineering and incident triage workflows to improve fidelity and contextual relevance of alerts. - Define, track, and analyze SOC Key Performance Indicators (KPIs) - such as Mean Time to Detect (MTTD), Mean Time to Repair (MTTR), analyst utilization, and false positive rates - to ensure compliance with Service Level Agreements (SLA) and drive continuous improvement. - Develop dashboards and reporting mechanisms to communicate Key Performance Indicator (KPI) trends, SOC effectiveness, and incident lifecycle insights to executive stakeholders and customers. - Provide guidance on active Plans of Action and Milestones (POA&M). - Lead the implementation and continuous improvement of Security Orchestration, Automation, and Response (SOAR) capabilities by developing automated playbooks to streamline triage, enrichment, and containment workflows, while tracking effectiveness through automation coverage, time savings, and reduced analyst fatigue. - Manage project tracking schedules, risk registers, and risk and issue mitigation strategies for SOC and incident response activities. - Ensure quality and timeliness of SOC deliverables. - Provide hands-on guidance, training, mentoring, and support to junior staff. - Other duties, as assigned. Now Requirements (mandatory): from "Required Skills" list (the heading "Required Skills" then list). Also earlier bits: U.S. citizen, Active DoW Secret or higher security clearance, Bachelor's degree in STEM, Minimum DoD 8570 IAT Level II compliant (Security+ or higher; Level III certification preferred), Ability to work in a hybrid on-site/remote environment with potentially up to 3 business days per week onsite at Everforth ECS Corporate offices in Merrifield, VA., 10+ years of progressive, operational cybersecurity experience, with at least 5 years leading SOC or incident response teams in a 24x7 environment., Proven expertise leading end-to-end incident management and response, from initial detection through containment, remediation, and post-incident analysis., Strong understanding of standards and requirements outlined by the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST)., Thorough knowledge and understanding of information security concepts, protocols, industry best practices, and principles as a means of relating business needs to security controls., Deep expertise in incident response, threat detection, SIEM operations, endpoint security, and SOC performance metrics, with a focus on driving detection efficacy and operational efficiency., Hands-on familiarity with platforms such as Splunk, Elastic, CrowdStrike, and SOAR tooling (Tines, Phantom, etc.)., Demonstrated success in building or maturing SOC operations for DoW, the Intelligence Community, or regulated enterprises., Keen ability to perform threat management and threat modeling in large environments; identify threat vectors, and develop recommendations to eliminate vulnerabilities / weaknesses., Demonstrated experience with: SOC team management and oversight of Incident Response engagements, Using cybersecurity tools to protect data and functional assets (i.e. Tenable, ServiceNow Discovery), Implementing advanced technologies, Creating security investigation guides and playbooks, Integrating cyber threat intelligence into a SOC, SOC process automation, Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution., Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management). That's a lot; many are skills but they are mandatory requirements. We'll put them under Requirements. Qualifications: maybe we can put education and certifications? But we already included degree and certifications in Requirements. Could still have a Qualifications section for "Bachelor's degree in a STEM discipline" etc. But to avoid duplication, maybe we skip Qualifications and put everything under Requirements. However instruction says we can include sections only when posting has real specific content. It's okay to omit Qualifications if we feel it's redundant. But we might still include Qualifications for education and certifications separate from experience. Let's see: The posting has "Required Skills" heading then list. It also earlier mentions "Bachelor's degree in a Science, Technology, Engineering, or Mathematics (STEM) discipline, or related field of study." and "Minimum DoD 8570 IAT Level II compliant (Security+ or higher; Level III certification preferred)." Those could be qualifications. We could treat Requirements as experience and mandatory clearances, and Qualifications as education/certifications. But the list also includes many skill requirements. Might be better to have Requirements (mandatory experience/clearance) and Skills (mandatory skills) and Desired Skills as Skills? Hmm. Given the instruction's headings list includes Skills as a possible section. So we can have: - About the role - Responsibilities - Requirements (maybe experience/clearance) - Skills (maybe technical skills) - Benefits - Pay - Schedule But we also have Desired Skills separate; we could put those under Skills as preferred? Or we could have a separate "Preferred Qualifications" but not in list. Since they didn't give us a heading for preferred, we could still include Skills section containing both required and desired? But they said use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can decide to put required skills under Requirements, desired skills under Skills. But the posting has "Required Skills" and "Desired Skills". So we could map Required Skills to Requirements, Desired Skills to Skills. However Requirements also includes experience etc. Might be okay. Let's extract Required Skills list (the bullet list after "Required Skills:"). It starts: "Required Skills: U.S. citizen.Active Department of War (DoW) Secret or higher security clearance.Bachelor's degree in a Science, Technology, Engineering, or Mathematics (STEM) discipline, or related field of study. Minimum DoD 8570 IAT Level II compliant (Security+ or higher; Level III certification preferred).Ability to work in a hybrid on-site/remote environment with potentially up to 3 business days per week onsite at Everforth ECS Corporate offices in Merrifield, VA.10+ years of progressive, operational cybersecurity experience, with at least 5 years leading SOC or incident response teams in a 24x7 environment.Proven expertise leading end-to-end incident management and response, from initial detection through containment, remediation, and post-incident analysis.Strong understanding of standards and requirements outlined by the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST).Thorough knowledge and understanding of information security concepts, protocols, industry best practices, and principles as a means of relating business needs to security controls.Deep expertise in incident response, threat detection, SIEM operations, endpoint security, and SOC performance metrics, with a focus on driving detection efficacy and operational efficiency.Hands-on familiarity with platforms such as Splunk, Elastic, CrowdStrike, and SOAR tooling (Tines, Phantom, etc.).Demonstrated success in building or maturing SOC operations for DoW, the Intelligence Community, or regulated enterprises.Keen ability to perform threat management and threat modeling in large environments; identify threat vectors, and develop recommendations to eliminate vulnerabilities / weaknesses.Demonstrated experience with:SOC team management and oversight of Incident Response engagementsUsing cybersecurity tools to protect data and functional assets (i.e. Tenable, ServiceNow Discovery)Implementing advanced technologiesCreating security investigation guides and playbooksIntegrating cyber threat intelligence into a SOCSOC process automationStrong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management)." That is a massive list; we can split into separate
• items. Now Desired Skills list: "Preference Shown To Candidates With Active DoW Top Secret or higher security clearance.Master’s degree in a STEM discipline.DoD 8570 IAT Level III compliant certification; CISSP, GIAC (GSOM, GCIH, GCIA, GCTI, GSOC, G