Manager, Security Operations Center

Jackson•Lansing, MI

About The Position

The Security Operations Center Manager is responsible for effective incident detection and response. This technical leader assesses existing and evolving threats to the company’s information systems, develops staff, matures processes, and continually aligns organizational capabilities with the highest-priority risks while integrating industry-leading solutions into operational processes.

Requirements

Bachelor’s degree required.
Seven or more years of information security-specific experience required.
Three or more years of management experience required.
Demonstrated enterprise-level knowledge of SIEM tools and processes.
Significant experience with enterprise networking, operating system configurations, identity management, authentication, authorization, and logging.
Strong working knowledge and experience with multifaceted forensic investigations, system vulnerability assessments, and security gap identification.
Thorough understanding and application of security concepts, protocols, and methodologies across multiple operating environments.
Experience with scripting, database query languages, and software deployment in an enterprise environment.
Ability to manage staff and administer personnel actions, including performance and salary reviews, hiring, corrective action, and terminations.
Strong verbal and written communication skills, including the ability to communicate technical issues effectively.
Excellent analytical and problem-solving skills.

Nice To Haves

CISSP (Certified Information Systems Security Professional) certification.
Additional relevant industry certification(s).

Responsibilities

Plan and organize daily SOC operations, inspect staff execution of defined processes, and ensure complete and accurate reporting of key performance indicators.
Provide thought leadership on capabilities needed for effective SOC operations by staying current with attacker techniques and defensive countermeasures.
Mentor, motivate, and develop staff; identify talent gaps and recruit to add needed capabilities.
Test and measure team effectiveness, identify and implement improvements, and ensure necessary documentation is complete and followed.
Validate the effectiveness of security tools, including sensors, scanners, log collection, correlation, and search, and tune them as necessary.
Continuously evaluate and refine SOC processes and procedures for effectiveness, efficiency, and alignment with evolving threats and business priorities.
Coordinate SOC resources with the Incident Response team during incident response.
Drive automation and orchestration of SOC workflows through SOAR, playbooks, and runbooks to reduce response times and analyst workload.
Support regulatory, audit, and compliance requirements related to security monitoring and incident response.
Ensure appropriate shift coverage, staffing levels, and escalation paths for continuous monitoring and response.
Operationalize threat intelligence within SOC monitoring and detection to proactively identify and respond to emerging threats.
Use AI as a standard part of SOC operations, incorporating it into detection engineering and analysts’ daily workflows to improve detection, investigation, response, and analyst efficiency.
Provide after-hours on-call assistance as needed.
Perform other duties and/or projects as assigned.