DMDC SOC Manager

Position OverviewSecurity Operations Center (SOC) ManagerLeidos is seeking an experienced cybersecurity operations leader to serve as the Security Operations Center (SOC) Manager supporting the Defense Manpower Data Center (DMDC) and the Defense Human Resources Activity (DHRA) within the Office of the Under Secretary of Defense for Personnel & Readiness (OUSD P&R).This Key Personnel position provides operational leadership for enterprise cyber defense supporting one of the Department of Defense's most critical information environments. DMDC maintains the Department's largest centralized repository of personnel, manpower, identity, readiness, pay, casualty, personnel security, entitlement, and financial information. The SOC Manager will lead the team responsible for protecting these mission-essential systems through continuous monitoring, cyber threat detection, incident response, and operational excellence.The selected candidate will provide leadership for Security Operations Center activities supporting a complex enterprise environment that includes approximately 15,000 network and endpoint devices, over 600 Government applications, approximately 100 Risk Management Framework (RMF) authorization boundaries, hybrid cloud environments, globally distributed infrastructure, and multiple cybersecurity service providers supporting worldwide operations.This role extends beyond daily SOC management. The SOC Manager serves as the operational leader responsible for establishing priorities, maturing cyber defense capabilities, improving operational processes, mentoring cybersecurity professionals, and ensuring Government leadership maintains timely awareness of significant cybersecurity events. Success in this position requires exceptional technical leadership, sound operational judgment, and the ability to lead high-performing teams in a mission-critical environment.Mission EnvironmentThe SOC Manager provides leadership supporting cybersecurity operations across a diverse enterprise consisting of:Approximately 15,000 network and endpoint devices.More than 600 Government-owned applications supporting DoD missions.Approximately 100 Risk Management Framework (RMF) authorization boundaries.Hybrid cloud environments including Oracle Cloud Infrastructure (OCI), Amazon Web Services (AWS), Software-as-a-Service (SaaS), and DISA-hosted capabilities.Worldwide enterprise infrastructure supporting personnel, identity, readiness, and mission support operations.Multiple Cybersecurity Service Providers (CSSPs) operating across the enterprise.Government and contractor-operated environments requiring close coordination between cybersecurity, IT operations, and mission stakeholders..Primary ResponsibilitiesProvide overall leadership and operational management of the Security Operations Center (SOC).Lead, mentor, and develop a high-performing team of cybersecurity professionals responsible for continuous monitoring, cyber threat detection, incident analysis, and incident response.Direct enterprise cyber incident response activities, ensuring rapid detection, analysis, containment, eradication, recovery, and reporting of cybersecurity events.Serve as the primary operational interface with Government leadership for SOC activities, ensuring timely communication regarding operational status, emerging threats, and significant cybersecurity incidents.Develop, implement, and continuously improve SOC standard operating procedures, incident response playbooks, analyst workflows, and training programs.Establish operational priorities and performance metrics that improve SOC effectiveness, operational maturity, and analyst readiness.Coordinate cyber defense activities across Government organizations, contractor teams, and external Cybersecurity Service Providers (CSSPs).Oversee continuous monitoring of enterprise networks, endpoints, cloud environments, applications, and cybersecurity tools to identify and mitigate evolving threats.Provide operational recommendations that reduce enterprise cyber risk and improve defensive capabilities.Ensure SOC operations comply with applicable DoD cybersecurity policies, DoD 8140 requirements, Risk Management Framework (RMF) guidance, and industry best practices.Support cybersecurity assessments, operational planning activities, and continuous process improvement initiatives.Foster a culture of accountability, collaboration, innovation, and operational excellence within the SOC.This position is designated as Key Personnel under the contract. The selected candidate will serve as the operational lead for Security Operations Center (SOC) activities and is expected to be available at contract start. Because of the critical nature of this role, any future personnel substitutions are subject to Government approval in accordance with contractual requirements.Work Location: This position supports a hybrid work environment; however, Key Personnel are expected to report to a government site. The selected candidate will be based at either the Mark Center in Alexandria, VA, or the DoD Center–Monterey Bay (DODC-MB) in Seaside, CA, in accordance with contract requirements.Basic QualificationsBachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline with 10 years of progressively responsible experience in cybersecurity operations, cyber defense, incident response, or Security Operations Center leadership. Additional relevant experience may be considered in lieu of a degree in accordance with Leidos equivalency guidelines.Demonstrated experience leading an enterprise Security Operations Center (SOC), Cyber Defense Team, Computer Network Defense (CND) organization, or equivalent cyber operations function.Demonstrated experience leading cyber incident response within large, complex enterprise environments.Experience managing and developing technical teams responsible for cyber operations.Experience developing SOC operating procedures, incident response playbooks, operational workflows, and performance metrics.Strong understanding of enterprise cybersecurity operations, SIEM technologies, endpoint detection and response (EDR), network security monitoring, threat detection, vulnerability management, and cyber incident management.Demonstrated ability to communicate cybersecurity risks, operational status, and technical issues to senior Government leadership and executive stakeholders.Active Secret Security Clearance with the ability to maintain the required clearance.Ability to satisfy applicable DoD 8140 certification requirements for the assigned work role.Experience aligned with DoD Cyber Workforce Framework (DCWF) Work Role 511 – Cyber Defense Analyst (Advanced).Ability to support onsite operations at the Government's Mark Center (Alexandria, VA) or DoD Center–Monterey Bay (Seaside, CA) in accordance with contract requirements.Preferred QualificationsPrevious experience supporting the Defense Manpower Data Center (DMDC), Defense Human Resources Activity (DHRA), or other Department of Defense organizations.Experience leading enterprise Security Operations Centers supporting Federal or Department of Defense customers.Experience operating within hybrid enterprise environments spanning on-premises infrastructure, Oracle Cloud Infrastructure (OCI), Amazon Web Services (AWS), and Software-as-a-Service (SaaS) platforms.Experience integrating cyber threat intelligence into enterprise monitoring and incident response operations.Familiarity with MITRE ATT&CK, Cyber Kill Chain, threat hunting methodologies, and advanced detection engineering.Experience implementing Security Orchestration, Automation, and Response (SOAR) capabilities and security automation initiatives.Working knowledge of the Risk Management Framework (RMF), eMASS, continuous monitoring, and enterprise cybersecurity compliance.Professional cybersecurity certifications such as CISSP, CISM, CASP+, GCIA, GCIH, GCFA, or equivalent.Excellent written and verbal communication skills with demonstrated experience briefing technical teams, program leadership, executive management, and Government customers.Demonstrated success leading organizational improvement initiatives, developing high-performing cybersecurity teams, and driving operational excellence within enterprise cyber defense organizations.Required Clearance:All applicants must possess an active DoD Secret clearance at time of consideration with the ability to maintain the required clearance.DMDC Cyber PrimesIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.Original Posting:July 28, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.Pay Range:Pay Range $131,300.00 - $237,350.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.SummaryLocation: Alexandria, VA; Seaside, CAType: Full time