SOC Operations Manager

SOC Operations ManagerRevolutional delivers advanced technology solutions and mission support to federal agencies across civilian, health, and national security environments. We apply modern capabilities, including AI/ML, cloud, cybersecurity, and IT modernization to solve complex challenges, enable faster and more secure operations, and drive measurable mission outcomes.We are redefining how federal technology gets built and delivered by operating with a product mindset, prioritizing speed, ownership, and execution over bureaucracy.This position supports a large-scale federal security operations program delivering 24/7/365 continuous monitoring, intrusion detection, incident response, and threat intelligence across a complex enterprise network environment. The SOC operates under demanding federal cybersecurity compliance requirements and supports multiple government stakeholders across classified and unclassified networks.The core challenge: sustaining Tier 2 threat watch operations at enterprise scale — validating events, driving accurate incident assessment, and keeping Tier 1 analysts focused, calibrated, and mission-ready around the clock.Position DescriptionAs a SOC Operations Manager at Revolutional, you lead the Tier 2 Threat Watch Officer function and are the senior operational authority for event validation, incident assessment, and analyst oversight during your watch. You validate and confirm security events, assess operational impact, correlate anomalies across IDS, IPS, and SIEM platforms, and make real-time recommendations that shape the program's defensive posture.You are a technically deep operator and a credible team leader. You oversee Tier 1 staff, author intrusion detection signatures, monitor High Value Assets, and maintain current threat awareness that you actively apply to improve the program's detection and response capabilities. When events require interagency coordination, you are the person who initiates and manages that engagement.What You Will OwnTier 2 Threat Watch Officer function and operational leadershipSecurity event validation, impact assessment, and escalation decisionsIDS/IPS/SIEM anomaly correlation and network configuration recommendationsIntrusion detection signature authorship and maintenanceHigh Value Asset monitoring and protection oversightTier 1 analyst oversight, performance, and operational disciplineInteragency coordination for significant security eventsCurrent threat awareness and its application to enterprise security postureResponsibilitiesLead the Tier 2 Threat Watch Officer function; serve as the senior operational authority for event triage, validation, and incident assessment during assigned watch periodsValidate and confirm security events; assess operational impact and determine appropriate response actions, escalation paths, and stakeholder notificationsCorrelate anomalies across IDS, IPS, and SIEM platforms to distinguish genuine threats from false positives and identify complex, multi-vector attack patternsRecommend network configuration changes to mitigate identified threats, close detection gaps, and strengthen defensive postureAuthor and maintain intrusion detection signatures to improve detection fidelity against current and emerging threat actors and TTPsMonitor High Value Assets and ensure heightened detection coverage, alert fidelity, and response readiness for critical systemsCoordinate with law enforcement, counterintelligence, and interagency partners on significant security events requiring external collaboration or notificationOversee Tier 1 SOC analysts; direct workload, validate analyst actions, enforce SOC procedures, and provide real-time coaching during active eventsMaintain current awareness of the threat landscape, adversary TTPs, and emerging attack vectors; actively apply threat intelligence to improve program detection and response capabilitiesDevelop and contribute to SOC playbooks, standard operating procedures, and shift documentationProduce accurate shift reports, incident summaries, and escalation notifications for program leadership and government stakeholdersWrite scripts in Python or equivalent languages to automate analyst workflows, improve detection capabilities, or support SOC tool managementWhat You Bring (Requirements)Baseline RequirementsBachelor's degree in Computer Science, Information Security, or related field (or equivalent experience)5 or more years of security operations experience, including hands-on Tier 2 or senior SOC analyst experienceDemonstrated experience in a supervisory or team lead capacity overseeing SOC analysts or watch floor operationsActive Secret clearance requiredTechnical & Domain CapabilitiesDeep experience with security event validation, IDS/IPS/SIEM correlation, and incident impact assessment in enterprise network environmentsHands-on experience authoring intrusion detection signatures for IDS/IPS platformsProficiency with SIEM platforms: search, correlation rule development, alert tuning, and dashboard operationsExperience monitoring High Value Assets and applying elevated detection and response protocolsDemonstrated ability to recommend and communicate network configuration changes based on threat analysis findingsExperience coordinating with external agencies or government partners during significant security eventsProficiency scripting in Python or equivalent language for SOC automation, workflow improvement, or tool integrationCurrent knowledge of adversary TTPs, threat actor trends, and the federal cybersecurity threat landscapeFamiliarity with FISMA, NIST incident response frameworks, and federal security operations standardsCore StrengthsTechnically authoritative Tier 2 operator — your event assessments are accurate, well-reasoned, and defensible under scrutinyDecisive under pressure: you make sound calls on complex, fast-moving events without waiting for perfect informationEffective supervisor who holds Tier 1 analysts to standard, develops their tradecraft, and keeps the watch floor operationally disciplinedClear communicator who produces crisp incident documentation, sharp shift handoffs, and credible interagency coordinationCertificationsOne or more of the following is preferred:CISSP, GCIA (GIAC Certified Intrusion Analyst), GCIH (GIAC Certified Incident Handler), CySA+, or equivalent security operations credentialNice to Have (Differentiators)Experience leading Tier 2 operations in a federal civilian, defense, or intelligence SOC environmentBackground in intrusion detection signature development for commercial and custom IDS/IPS platformsFamiliarity with High Value Asset (HVA) monitoring frameworks and CISA HVA assessment processesExperience with threat hunting or kill-chain-based detection methodologiesFamiliarity with Zero Trust monitoring or cloud-native SOC operationsActive TS/SCI clearance