Security Operations Center Manager (CBP)

Agile Defense•Ashburn, VA

3d•Onsite

About The Position

The U.S. Customs and Border Protection (CBP) runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. Every system that keeps that mission running, from biometric checks against watchlists to apprehension processing and surveillance feeds, is a potential target. An undetected intrusion risks not only data but also operational capability. This role involves managing the security operations center responsible for monitoring these systems, triaging alerts, prioritizing work, and ensuring the center's overall performance. The manager will collaborate closely with leads for insider threat monitoring, threat hunting, incident response, digital forensics, and vulnerability assessment, ensuring these functions work cohesively. A key aspect of the role is effectively communicating the SOC's performance and the program's exposure to leadership in an actionable manner.

Requirements

Experience running a security operations center or an equivalent detection and response function.
Experience managing a team through a real incident and the ability to discuss lessons learned and improvements.
Experience reporting security posture and incidents to non-technical leadership, including how communication strategies have evolved.
Experience working within a federal or highly regulated security program.
Comfort with disciplines including insider threat, threat hunting, incident response, forensics, and vulnerability assessment, even without being the deepest technical expert in each.
U.S. Citizenship required.

Nice To Haves

Active CBP Background Investigation (CBP BI) and EOD strongly preferred.
Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.
Certifications such as CISSP, GCIH, or CISM.

Responsibilities

Run a security operations center that effectively catches critical incidents and filters out noise.
Ensure alerts are triaged quickly, and analysts can differentiate between escalations and closures with clear, documented standards.
Tune out recurring false positives at the source to avoid re-triaging each shift.
Integrate specialist functions (insider threat, threat hunt, incident response, forensics, vulnerability assessment) into a cohesive operation with clear handoffs and accountability for next steps.
Identify and address potential bottlenecks in SOC functions before they impact overall performance.
Maintain consistent coverage across shifts and staffing gaps.
Provide leadership with accurate reporting on SOC performance and program exposure, focusing on changes and their implications rather than just ticket counts.
Escalate risks requiring decisions above the SOC manager's level to the appropriate decision-makers in a timely manner.
Communicate the true severity and impact of incidents accurately from the outset.
Implement improvements to SOC operations based on lessons learned from incidents.
Foster analyst development and skill enhancement.
Develop and maintain standards and playbooks for recurring SOC work, ensuring they are followed due to their effectiveness under real conditions.