Security Operations Center (SOC) Manager

Job DescriptionEverforth ECS is seeking a Security Operations Center (SOC) Manager to work in our Fairfax, VA office in a hybrid remote/on-site capacity. Everforth ECS is seeking an experienced, outcome-driven Security Operations Center (SOC) Manager to work in our Fairfax, VA office in support of DoW environment U.S. Coalition Mission Partner Environments (MPE), each with a unique set of data and applications. The SOC Manager will oversee personnel responsible for 24x7x365 SOC services that provide proactive and real-time monitoring, detection, analysis, quantification, response, and reporting capabilities for cybersecurity events and incidents in accordance with Federal laws and regulations. These services include continuous cybersecurity monitoring of Enclave IT systems and assets; investigation of security alerts; incident triage; root cause analysis; and full-spectrum incident response activities – including containment, remediation, and recovery – to ensure complete system restoration. The SOC Manager will drive the Enclaves’ full recovery from cyber incidents and ensure adherence to Federal incident management and reporting requirements that are central to these security operations. The SOC Manager will report directly to the Defense & Intel Business Unit’s Platforms Solutions Division Vice President. Primary Responsibilities:Build, deploy, and maintain a comprehensive SOC program leveraging best practices and compliant with client standards and requirements.Oversee the Secure Unclassified Network (SUNet) SOC and coordinate all SOC activities including Tier support.Serve as the primary incident commander for all SOC cybersecurity incidents.Support the development of SOC plans, policies, and standard operating procedures (SOP).Act as the primary SOC liaison with external agencies, mission partners, and third-party vendors during joint investigations and coordinated incident response efforts.Represent SOC capabilities and readiness during stakeholder meetings, program reviews, and federal oversight briefings.Integrate cyber threat intelligence (CTI) into SOC detection engineering and incident triage workflows to improve fidelity and contextual relevance of alerts.Define, track, and analyze SOC Key Performance Indicators (KPIs) – such as Mean Time to Detect (MTTD), Mean Time to Repair (MTTR), analyst utilization, and false positive rates – to ensure compliance with Service Level Agreements (SLA) and drive continuous improvement.Develop dashboards and reporting mechanisms to communicate Key Performance Indicator (KPI) trends, SOC effectiveness, and incident lifecycle insights to executive stakeholders and customers.Provide guidance on active Plans of Action and Milestones (POA&M).Lead the implementation and continuous improvement of Security Orchestration, Automation, and Response (SOAR) capabilities by developing automated playbooks to streamline triage, enrichment, and containment workflows, while tracking effectiveness through automation coverage, time savings, and reduced analyst fatigue.Manage project tracking schedules, risk registers, and risk and issue mitigation strategies for SOC and incident response activities.Ensure quality and timeliness of SOC deliverables.Provide hands-on guidance, training, mentoring, and support to junior staff.Other duties, as assigned.Salary: $190,000 - $225,000General Description of BenefitsJob RequirementsRequired Skills:U.S. citizen.Active Department of War (DoW) Secret or higher security clearance.Bachelor's degree in a Science, Technology, Engineering, or Mathematics (STEM) discipline, or related field of study. Minimum DoD 8570 IAT Level II compliant (Security+ or higher; Level III certification preferred).Ability to work in a hybrid on-site/remote environment with potentially up to 3 business days per week onsite at Everforth ECS Corporate offices in Merrifield, VA.10+ years of progressive, operational cybersecurity experience, with at least 5 years leading SOC or incident response teams in a 24x7 environment.Proven expertise leading end-to-end incident management and response, from initial detection through containment, remediation, and post-incident analysis.Strong understanding of standards and requirements outlined by the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST).Thorough knowledge and understanding of information security concepts, protocols, industry best practices, and principles as a means of relating business needs to security controls.Deep expertise in incident response, threat detection, SIEM operations, endpoint security, and SOC performance metrics, with a focus on driving detection efficacy and operational efficiency.Hands-on familiarity with platforms such as Splunk, Elastic, CrowdStrike, and SOAR tooling (Tines, Phantom, etc.).Demonstrated success in building or maturing SOC operations for DoW, the Intelligence Community, or regulated enterprises.Keen ability to perform threat management and threat modeling in large environments; identify threat vectors, and develop recommendations to eliminate vulnerabilities / weaknesses.Demonstrated experience with:SOC team management and oversight of Incident Response engagementsUsing cybersecurity tools to protect data and functional assets (i.e. Tenable, ServiceNow Discovery)Implementing advanced technologiesCreating security investigation guides and playbooksIntegrating cyber threat intelligence into a SOCSOC process automationStrong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management).Job DetailsJob Type: Full-timeCategory: CybersecuritySalaried: Salaried