Sr. SOC Project Manager

Location: (New Carolton, MD or Kearneysville, WV)

Terms: Full-time

Clearance: Top Secret

Travel: 0% (onsite presence at client facilities as directed)

Position Description

We are seeking an experienced SOC Project Manager to lead day-to-day Security Operations Center (SOC) operations for a large federal agency. This Key Personnel role manages the SOC function through subordinate leads, directs 24x7x365 incident management operations across multiple sites, and serves as the senior technical lead and primary operational point of contact with the client’s SOC leadership. The SOC Project Manager is responsible for the strategic and operational direction of the SOC, ensuring the identification, triage, analysis, response, and recovery from cybersecurity incidents across an enterprise of hundreds of thousands of network connections and endpoints in on-premises and cloud environments.

The successful candidate will:

• Serve as the senior technical lead for day-to-day coordination with the client’s SOC leadership team.
• Deliver continuous 24x7x365 SOC coverage with no holiday or leave gaps, with sufficient staffing at each site to operate independently in emergencies.
• Meet or exceed performance standards for incident review, escalation, and alarm response times.
• Drive incident handling across all five NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, and Recover.
• Maintain COOP readiness and lead SOC operations at alternate sites when COOP is invoked.
• Influence SOC practices and communicate effectively with client executive leadership.
• Continuously improve incident handling processes, procedures, playbooks, and communications based on lessons learned.

Responsibilities:

• Manage the strategic and operational direction of SOC incident management and operational coordination through subordinate shift leads and analysts.
• Coordinate day-to-day SOC activities with client SOC leadership, including incident escalations, operational risks, staffing coverage concerns, and service-impacting issues.
• Oversee real-time alert monitoring and triage, incident report intake and coordination, incident analysis, forensic and malware analysis, and containment, eradication, and recovery activities.
• Ensure incident ticket generation, assignment, acknowledgement, notification, escalation, and resolution occur within established timeframes.
• Direct coordination of incident reporting to oversight organizations, CISA, and other external partners on behalf of the client.
• Build and manage shift schedules, on-call rosters, and staffing across multiple sites to ensure 24x7x365 coverage and reliable on-call reachability.
• Ensure SOC personnel complete required training, access procedures, certifications, and on-the-job skills evaluations before receiving privileged access.
• Review and approve incident analysis and forensic findings reports.
• Develop and maintain COOP plans and procedures; participate in COOP exercises, contingency and disaster recovery tests, training, and exercises; and lead SOC operations at the alternate site when invoked.
• Maintain and update SOC operating procedures, incident handling documentation, escalation procedures, contact lists, and knowledge content.
• Coordinate SOC operations with threat intelligence, threat hunting, and SOC engineering teams to translate incident findings into detection and process improvements.
• Provide recurring operational status updates, ticket trends, significant risks, and planned near-term activities to client SOC leadership and the Program Manager.
• Support classified-space alarm response requirements as assigned.
• Identify recurring operational issues and recommend practical improvements to incident handling processes and communications.
• Support surge activation for emerging threats and major incidents.

Required Skills and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• 10+ years of professional experience.
• Ten (10) years of experience running a SOC, with at least five (5) years running a combined on-premises/cloud SOC.
• Ten (10) years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints, with duties that include all five functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover).
• Demonstrated ability to manage a function or organization through subordinate management.
• Ability to influence others to accept practices and approaches, and to communicate with and influence executive leadership.
• Experience managing 24x7x365 SOC operations, including shift scheduling, on-call support, escalation procedures, and service level objectives.
• Working knowledge of NIST SP 800-61, NIST SP 800-53, FISMA, and federal incident reporting requirements (e.g., CISA reporting).
• Experience with SIEM, SOAR, EDR, and incident ticketing/case management tools.

Desired

• Experience managing a federal civilian agency SOC or incident response center.
• Experience with COOP planning and execution and multi-site SOC operations.
• Experience monitoring and responding to incidents in AWS and Microsoft Azure/M365 environments.
• Certifications such as CISSP, CISM, GIAC (GCIH, GSOM, GCIA), or PMP.
• Experience coordinating with CISA, FBI, and other law enforcement and intelligence partners.
• Active Top Secret clearance.

Work Authorization/Clearance: U.S. Citizenship is required with Top Secret Clearance.