Security Operations Center (SOC) Manager

MAD Security•Huntsville, AL

5d•Onsite

About The Position

The Security Operations Center (SOC) Manager leads the SOC Desk Manager and SOC Technical Lead, and through them the entire SOC team. The manager sets service direction while their managers run day-to-day operations. The role works with network and firewall engineers, cyber operations technical leads, and compliance consultants at a company that is CMMC Level 2 certified and an authorized C3PAO. The manager is accountable for outcomes of the 24/7 SOC, including client service performance, operating standards, staffing, training and certification standards, reporting, capacity planning, detection quality, threat hunting, and incident response. The role represents the SOC’s operational position in client and commercial decisions and resolves conflicts between SOC standards and client commitments. It also leads, coaches, and develops managers and staff; supports hiring, onboarding, and performance management; champions AI and automation while maintaining human oversight of critical decisions; and communicates with clients, the team, and executive leadership. The position is full-time and onsite at MAD Security headquarters in Huntsville, Alabama, in an office setting within and adjacent to the 24/7 SOC. The schedule is weekday business hours, with availability for escalation outside those hours. The role involves regular client communication and occasional travel for client meetings and industry events. The SOC is staffed by U.S. personnel, and the manager must be a U.S. person.

Requirements

At least eight years of experience in information security and/or IT, including significant SOC experience in an enterprise or MSP/MSSP environment.
At least three years leading a SOC or comparable team.
Demonstrated experience running a security operations function or comparable 24/7 operation, internal or client-facing, with accountability for outcomes, capacity, and standards.
Experience managing performance against SLAs or service-level expectations and KPIs.
Experience leading and developing managers and technical leads.
Bachelor’s degree in Information Technology, Information Security/Assurance, Computer Science, or equivalent experience.
Deep familiarity with SIEM, SOAR, incident response, firewall management, and vulnerability management.
Familiarity with applying AI and automation in a SOC, with sound judgment about where human oversight is essential.
Must be a U.S. person.
Decisiveness, ability to lead through managers and develop leaders, ability to represent operational positions to executives and clients, integrity, self-management, customer focus, and a collaborative attitude.

Nice To Haves

Master’s degree.
CISSP or CISM certification; CISSP-ISSMP is an additional plus.
Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012 incident reporting obligations.
Experience building or scaling a SOC or managed security service.

Responsibilities

Oversee the 24/7 SOC and own its outcomes for clients, including performance against client SLAs and KPIs.
Run the SOC service to its published operating standards; staff the service, enforce standards, and improve them where needed.
Own SOC tier definitions and the SOC team’s training and certification standards; enforce and maintain them.
Own SOC measurables, reporting cadence, capacity reporting, and planning.
Represent the SOC’s operational position in client and commercial decisions and address conflicts between SOC standards and client commitments.
Drive detection quality, threat hunting, and incident response effectiveness; assume incident command on declared incidents when required.
Lead, coach, and develop the SOC Desk Manager and SOC Technical Lead, and through them the SOC tiers.
Hire, onboard, and manage the performance of SOC staff.
Champion AI and automation in SOC workflows while preserving human oversight of critical decisions.
Communicate regularly with clients, the team, and executive leadership.
Ensure tier responsibilities, training, operating standards, SLA and KPI reporting, capacity planning, detection validation, and coverage boundaries are maintained and reviewed as described in the first-year success criteria.