Security Operations Manager

The Security Operations Manager is the senior technical leader and final escalation point for security events across Scarlett's managed clients. This is a hands‑on leadership role. The Manager leads day‑to‑day delivery of managed security services while remaining directly involved in detection, investigation, and incident response. The position sits between security strategy, owned by the vCISO, and execution, carried out by the SOC team. The Manager is accountable for the security posture and incident outcomes our clients experience. The role is outcome-driven, focused on reducing client risk, improving response times, and being the dependable last line of decision‑making when a security event escalates. Responsibilities & Duties: Security Leadership and Escalation Serve as the final escalation point for security alerts and incidents across all managed clients. Lead and develop the Security Operations team with direct, hands‑on coaching and clear accountability. Establish roles, expectations, KPIs, and escalation paths for the SOC team. Own queue health across all managed clients, including alert volume, aging, assignment, and first‑line escalation. Delegate day‑to‑day queue work to SOC team members while retaining accountability for the outcome. Work the security queue directly when volume exceeds team capacity or when SOC team members are on PTO, out, or otherwise unavailable. This is a working leadership role and queue coverage is an expected part of it, not an exception. SOC and Incident Response Oversee daily SOC operations, including monitoring, alert triage, and response. Lead containment, eradication, and recovery during security incidents, and own post‑incident root cause analysis and documentation. Engage Advanced Services for deep forensic analysis when an incident requires it. Improve detection logic, alert quality, and response workflows on an ongoing basis. Manage MDR and SIEM partner relationships and hold them to service expectations. Client Security Accountability Own the security outcomes managed clients experience: detection quality, response speed, containment, and client confidence. Serve as the senior technical voice in client‑facing security conversations covering incidents, posture, reporting, and remediation. Partner with the vCISO and account teams to align operations with client roadmaps and compliance requirements. Operational Excellence Develop and maintain runbooks, playbooks, and standard operating procedures. Track performance against response times, detection accuracy, and SLA adherence, and act on trends to reduce noise and improve efficiency. Partner with Advanced Services on detection engineering, automation, and tooling, including EDR/XDR, log and SIEM ingestion, identity protection, and email security, rather than maintaining a separate engineering function. Cross-Functional Collaboration Coordinate security‑related work with Support, NOC, and Professional Services. Ensure clean escalation and resolution across operational teams. Contribute to company‑wide automation, AI, and service delivery initiatives. Other To support onboarding, training, and team integration, employees in this position are expected to work onsite during their first 90 days of employment unless the position is specifically designated as fully remote. Following successful completion of the introductory period, employees may participate in the Company's flexible work arrangements in accordance with business needs, role requirements, manager discretion, and Company policy. Other duties as assigned. Qualifications: Experience 4 to 6 years in cybersecurity or security operations, including direct experience triaging alerts and responding to security incidents. 2 or more years in a leadership role, formal or informal, including mentoring or directing other analysts. MSP, MSSP, or multi‑client environment strongly preferred. Technical Expertise Strong working knowledge of endpoint detection and response (EDR/XDR), SIEM and log management, identity and access management (Entra, Conditional Access), and email security. Comfort serving as the final technical decision‑maker under pressure during active incidents. Familiarity with security frameworks (NIST, CIS, ISO) and compliance‑driven environments. CMMC and NIST 800‑171 experience is a plus. Leadership Skills Strong coaching, team development, and performance management capabilities. Excellent communication, including translating technical issues for business stakeholders. Sound problem‑solving and decision‑making under pressure. Education and Certifications Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent experience. Preferred: Security+, CySA+, GCIH, or equivalent. CISSP, GCFA, or other advanced certifications are a plus but not expected. Environmental and Physical Requirements: The work environment for this position is a standard office setting. The employee is regularly required to sit, stand, walk, and use hands to operate a computer and other office equipment. The employee must occasionally lift and/or move up to 25 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. What Success Looks Like Incidents are resolved at this level without routinely reaching the vCISO or executive leadership. Alerts are high quality, actionable, and efficiently resolved. Incident response is fast, structured, and well communicated. The team is engaged, growing, and aligned to outcomes. Clients trust Scarlett with their security and stay because of it. Compensation Base salary range: $80,000 to $95,000 annually, dependent on incident response experience, leadership experience, and certifications. Salaried and exempt. On‑call participation and after‑hours incident work are compensated within base salary rather than through hourly or overtime pay. Eligible for standard company benefits and any applicable performance incentive. Standard office environment with after‑hours coordination during security incidents. Participates in the standing on‑call and escalation rotation alongside SOC team members. Serves as backstop on‑call coverage when the rotation cannot be filled, including PTO, holidays, unplanned absences, and periods of elevated alert or incident volume. Availability outside standard hours is expected during active incidents and coverage gaps. The role is exempt and compensated on outcomes rather than hours. #J-18808-Ljbffr The Scarlett Group