SOC Lead

Role Description

The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA.

• Lead Tier I/II/III SOC operations with full escalation authority.
• Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation).
• Oversee the incident lifecycle from triage through investigation, response, and closure.
• Act as incident commander during high-severity events, coordinating stakeholder communication.
• Review and approve incident classifications, escalations, and remediation actions.
• Conduct daily/weekly operational reviews, tracking incident trends and performance metrics.
• Collaborate with engineering teams to improve detection rules and reduce false positives.
• Ensure all incidents are documented and audit-ready for compliance assessments.

Qualifications

• 8-10+ years of experience in SOC operations and incident management.
• Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK).
• Proven ability to lead cross-functional SOC teams and enforce SLA compliance.
• Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics.
• Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks.

Requirements

• Certifications (Preferred / Mandatory):
• CISSP (Certified Information Systems Security Professional)
• GIAC (GCIH / GCIA / GCFA)
• Microsoft Certified: Security Operations Analyst (SC-200)
• ITIL / PMP (optional but valuable for governance)