SOC Watch Officer

SOC Watch Officer

As a SOC Watch Officer at Revolutional, you are the senior authority on the floor during your watch. You are responsible for the operational integrity of a 24/7/365 security operations mission — overseeing analyst activity, managing active security events, and making real-time decisions that protect a large-scale federal network environment.

You are not a passive supervisor. You monitor what your analysts are working, catch what they miss, direct response actions on active incidents, and ensure nothing falls through the cracks across your shift. When events escalate, you are the first line of senior judgment before it reaches the SOC Team Lead.

Responsibilities

• Maintain situational awareness across all active monitoring queues, open incidents, and security events during assigned watch
• Supervise SOC analysts on shift; direct workload, review analyst actions, and ensure response quality and timeliness meet program standards
• Make real-time operational decisions on event triage, escalation, and response prioritization during your watch
• Serve as the shift escalation point for complex or high-severity events; determine when incidents require SOC Team Lead or program leadership notification
• Ensure accurate, timely documentation of all security events, analyst actions, and incident status throughout the shift
• Conduct shift turnover briefings; communicate open incidents, active threats, and watch floor status to incoming personnel with full fidelity
• Monitor SOC tooling and sensor coverage during watch; escalate gaps, outages, or anomalies that affect detection capability
• Enforce adherence to SOC playbooks, standard operating procedures, and incident handling protocols across the shift team
• Support incident response activities through containment and remediation, coordinating with relevant technical teams as needed
• Contribute to after-action reviews, shift reports, and continuous improvement of watch floor operations

What You Bring (Requirements)

Baseline Requirements

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience)
• 3 or more years of supervisory experience in a security operations or related technical environment
• Substantial hands-on security operations experience, including monitoring, detection, and incident response in enterprise network environments
• Active Secret clearance; Top Secret/SCI eligibility required

Technical & Domain Capabilities

• Deep familiarity with SOC operations: continuous monitoring, alert triage, log analysis, and threat detection across complex network environments
• Experience managing or directing analyst teams during active security incidents
• Proficiency with SIEM platforms, EDR tools, and network monitoring technologies used in enterprise SOC environments
• Understanding of incident response procedures from detection through containment and remediation
• Familiarity with FISMA, NIST incident response frameworks, and federal security operations standards
• Working knowledge of network security architectures including LANs, WANs, and cloud environments

Core Strengths

• Decisive under pressure — you make sound calls on active incidents without waiting for perfect information
• Strong situational awareness: you track multiple active events simultaneously and know which ones need your attention first
• Effective shift supervisor who holds analysts accountable and maintains operational discipline across the watch floor
• Clear communicator who writes clean incident documentation and delivers crisp shift handoffs

Certifications

One certification from each of the following groups is required:

Group 1 — Security Operations

• CASP+ (CompTIA Advanced Security Practitioner), CCSP (Certified Cloud Security Professional), SSCP (Systems Security Certified Practitioner), GMON (GIAC Continuous Monitoring), GCIH (GIAC Certified Incident Handler), GCIA (GIAC Certified Intrusion Analyst), or GECD (GIAC Enterprise Cloud Defense)

Group 2 — DoD 8570 CSSP

• Any certification qualifying under the DoD 8570 CSSP Analyst, Infrastructure Support, or Incident Responder categories

Note: 6 years of equivalent hands-on security operations experience may be considered in lieu of one certification requirement.

Nice to Have (Differentiators)

• Experience as a watch officer or shift lead in a federal civilian, defense, or intelligence SOC environment
• Familiarity with tier-less SOC operations and cross-functional incident coordination
• Background in threat hunting, APT detection, or kill-chain-based response methodologies
• Experience with Zero Trust monitoring or cloud-based security operations
• Active TS/SCI clearance