Security Operations Center Manager

Skyline Technology Solutions, LLC•Glen Burnie, MD

About The Position

Our new teammate is a servant leader and coach who fosters psychological safety, provides clear feedback, and actively develops successors while remaining calm and credible in high‑pressure incidents. They are technically hands-on with SIEM, EDR, and SOAR, fluent in detection engineering, threat hunting, and cloud identity, and known for turning real-world TTPs into tested detections and automated playbooks that measurably reduce risk. Equally business‑savvy, they quantify risk, align SOC outcomes to enterprise priorities, and communicate concise, outcome-focused narratives that resonate with both engineers and executives You can expect to spend your time accomplishing the following: 35% of your time on Objective 1: People and Operations 25% of your time on Objective 2: Incident Response and Automation 20% of your time on Objective 3: Detection Engineering and Data Quality 20% of your time on Objective 4: Metrics, Reporting, and Platform Efficiency

Requirements

5+ years of experience in cybersecurity operations (required)
Experience coordinating cybersecurity incident response

Nice To Haves

4-year degree in Cybersecurity, Computer Science, Information Technology, or other related disciplines from an accredited university (preferred)
ISC2 Certified Information Systems Security Professional (preferred)

Responsibilities

Build and maintain staffing plans, rotations, and on‑call to prevent burnout and ensure coverage.
Coach on case handling, root‑cause thinking, and communication; run regular knowledge shares and post‑incident reviews.
Maintain and rehearse playbooks for top incident types (phishing, malware on endpoint, identity compromise, data exfil).
Use SOAR to automate repetitive steps (enrichment, containment actions, evidence collection) and enforce workflows.
Define clear severity tiers, escalation paths, and major-incident roles across security, IT, legal, and communications.
Maintain a use‑case lifecycle from initial concept through retirement. track ownership and review dates.
Map detections to top organizational risks and ATT&CK techniques relevant to the environment.
Continuously tune rules to reduce false positives and duplicates; add severity logic tied to asset criticality.
Develop new SOC reporting (outcomes, trends, backlogs, risks) for executives and stakeholders.
Continuously improve processes using metrics; maintain a prioritized backlog for tuning, content, and automation work.