Security Operations Center (SOC) Manager

Nelnet•Lincoln, NE

1d•$105,000 - $140,000•Hybrid

About The Position

Nelnet is hiring a Security Operations Center (SOC) Manager to lead security monitoring, incident response, and threat detection across a regulated financial services environment that protects the data of millions of customers. The manager leads security analysts, incident responders, and threat intelligence specialists, while shaping detection strategy and advancing automation and SOAR adoption. The role partners with Security Engineering, Vulnerability Management, Detection Engineering, Red Team, Risk, IT, Compliance, and business units to protect the confidentiality, integrity, and availability of Nelnet’s critical assets. The position oversees day-to-day SOC operations, including monitoring, alert triage, detection, and security event analysis. It also leads incident response and cyber threat intelligence, develops and maintains SOC and incident response procedures, and uses metrics such as MTTD and MTTR to improve outcomes. The manager is expected to build a modern, intelligence-driven SOC through detection engineering, alert tuning, automation, responsible use of AI tools, and continuous improvement. This position offers a hybrid work option for associates living within 30 miles of an office location: remote work for part of the week, with in-office presence three days per week. Candidates must already be authorized to work in the United States without current or future visa sponsorship.

Requirements

Bachelor’s degree in computer science, Information Security, or a related field, or equivalent practical experience.
At least 3 years of cybersecurity experience, including at least 2 years working in a Security Operations Center (SOC).
At least 1 year of experience leading or managing a team, including in a team lead or supervisor role.
Hands-on expertise with SIEM platforms such as Splunk, Google SecOps, or LogRhythm, including investigation, correlation rules, detection engineering, and alert tuning.
Working knowledge of SOAR, firewalls, and EDR platforms such as CrowdStrike, SentinelOne, or Microsoft Defender.
Proven experience leading incident response from detection through containment, eradication, recovery, and post-incident review.
Solid understanding of threat intelligence principles and frameworks, including MITRE ATT&CK.
Strong analytical, problem-solving, and decision-making skills, including the ability to stay calm under pressure in a fast-paced environment.
Excellent written and verbal communication skills, including the ability to brief technical teams and executive leadership.
Must already be authorized to work in the United States without the need for current or future visa sponsorship.

Nice To Haves

Professional certifications such as CCSP, CISM, BTL1, BTL2, CompTIA Security+ or CySA+, or GIAC GSEC, GCIH, GCIA, or GCDA.
Experience with cloud security monitoring in AWS, Azure, or Google Cloud.
Knowledge of security and compliance frameworks such as NIST CSF, NIST 800-53, ISO 27001, and PCI DSS.
Experience with scripting or automation in Python or PowerShell.
Background in financial services or another regulated industry.
Experience with digital forensics, threat hunting, or Purple Team exercises.
Familiarity with AI tools such as Codex, Claude, and Gemini and responsible use of them to improve SOC processes, investigations, and analyst productivity.

Responsibilities

Lead, coach, and mentor security analysts, incident responders, and threat intelligence specialists; build a collaborative, high-performance team culture.
Set team goals, conduct performance reviews, identify training and certification needs, and manage staffing, shift coverage, and on-call schedules.
Oversee daily security monitoring, alert triage, detection, and analysis of security events.
Develop and maintain SOC policies, procedures, playbooks, and workflows.
Manage and optimize SIEM, SOAR, EDR, and threat intelligence platforms.
Drive detection engineering and alert tuning to reduce false positives and close visibility gaps.
Define, track, and report SOC metrics and KPIs, including MTTD, MTTR, alert volume, and detection coverage.
Ensure timely and accurate incident escalation in line with Nelnet’s incident response plan.
Lead incident response through containment, eradication, and recovery; maintain the incident response plan and conduct testing and tabletop exercises.
Conduct post-incident reviews and apply lessons learned to improve tools, processes, and detections.
Lead the cyber threat intelligence function by setting intelligence requirements and priorities aligned with business risks and the threat landscape.
Produce and share actionable threat intelligence, including threat actor tracking, indicators of compromise, and tactics, techniques, and procedures.
Translate intelligence into detections, hunts, and response playbooks, and brief security leadership on emerging threats.
Participate in industry intelligence-sharing communities and partner with external peers on threat information.
Identify and automate repetitive SOC tasks using SOAR playbooks and scripting.
Apply AI tools such as Codex, Claude, and Gemini to improve SOC processes, alert triage, and investigations, with appropriate human review and data-handling controls.
Align detections to frameworks such as MITRE ATT&CK.
Partner with Vulnerability Management, Security Engineering, Detection Engineering, Risk Management, IT, Compliance, and business units.
Work with external partners such as law enforcement, industry peers, and managed security vendors as needed.
Lead and collaborate on Purple Teaming exercises to improve security posture.