Security Operations Center (SOC) Manager

Nelnet Servicing•Lincoln, NE

22h•Hybrid

About The Position

Nelnet is hiring a Security Operations Center (SOC) Manager to lead the team responsible for detecting and investigating cyber threats across a regulated financial services environment that protects millions of customers’ data. The manager will oversee security monitoring, incident response, threat detection, and cyber threat intelligence, while leading security analysts, incident responders, and threat intelligence specialists. This hands-on leadership role will shape detection strategy, advance automation and SOAR adoption, and collaborate with Security Engineering, Vulnerability Management, Detection Engineering, Red Team, Risk, and other partners to protect Nelnet’s critical assets. The SOC Manager will develop the team and its operating practices, manage monitoring and response operations, guide incident response from detection through recovery, and turn threat intelligence into detections, hunts, and playbooks. The role will track and report SOC performance, improve detection and response times, and promote continuous improvement through automation, testing, and collaboration. Nelnet uses a hybrid work environment: associates living within 30 miles of an office location may work remotely for part of the week and are expected to be in the office three days per week. Visa sponsorship is unavailable; candidates must already be authorized to work in the United States without current or future sponsorship.

Requirements

Bachelor’s degree in computer science, information security, or a related field, or equivalent practical experience.
At least 3 years of cybersecurity experience, including at least 2 years working in a Security Operations Center (SOC).
At least 1 year of experience leading or managing a team, including in a team lead or supervisor role.
Hands-on expertise with SIEM platforms such as Splunk, Google SecOps, or LogRhythm, including investigation, correlation rules, detection engineering, and alert tuning.
Working knowledge of SOAR, firewalls, and EDR platforms such as CrowdStrike, SentinelOne, or Microsoft Defender.
Proven experience leading incident response from detection through containment, eradication, recovery, and post-incident review.
Solid understanding of threat intelligence principles and frameworks, including MITRE ATT&CK.
Strong analytical, problem-solving, and decision-making skills, including the ability to stay calm under pressure in a fast-paced environment.
Excellent written and verbal communication skills, with the ability to brief technical teams and executive leadership.
Must already be authorized to work in the United States without the need for current or future visa sponsorship.

Nice To Haves

Professional certifications such as CCSP, CISM, BTL1, BTL2, CompTIA Security+ or CySA+, or GIAC GSEC, GCIH, GCIA, or GCDA.
Experience with cloud security monitoring in AWS, Azure, or Google Cloud.
Knowledge of compliance and security frameworks such as NIST CSF, NIST 800-53, ISO 27001, and PCI DSS.
Experience with scripting or automation in Python or PowerShell.
Background in financial services or another regulated industry.
Experience with digital forensics, threat hunting, or Purple Team exercises.
Familiarity with AI tools such as Codex, Claude, and Gemini, and their responsible use to improve SOC processes, investigations, and analyst productivity.

Responsibilities

Lead, coach, and mentor security analysts, incident responders, and threat intelligence specialists; build a collaborative, high-performance team culture.
Set team goals, conduct performance reviews, and identify training and certification needs.
Manage staffing, shift coverage, and on-call schedules to support security monitoring and response.
Oversee daily security monitoring, alert triage, and the detection and analysis of security events.
Develop and maintain SOC policies, procedures, playbooks, and workflows.
Manage and optimize SIEM, SOAR, EDR, and threat intelligence platforms.
Drive detection engineering and alert tuning to reduce false positives and close visibility gaps.
Define, track, and report SOC metrics and KPIs, including MTTD, MTTR, alert volume, and detection coverage.
Ensure timely and accurate escalation of incidents in accordance with Nelnet’s incident response plan.
Lead and coordinate incident response through containment, eradication, and recovery.
Develop and maintain the incident response plan and conduct regular testing and tabletop exercises.
Conduct post-incident reviews and implement lessons learned in tooling, processes, and detection.
Lead the cyber threat intelligence function, setting intelligence requirements and priorities based on business risks and the threat landscape.
Produce and share actionable threat intelligence, including threat actor tracking, indicators of compromise, and tactics, techniques, and procedures.
Translate intelligence into detections, hunts, and response playbooks, and brief security leadership on emerging threats.
Participate in industry intelligence-sharing communities and exchange threat information with external peers.
Identify repetitive SOC tasks for automation using SOAR playbooks and scripting.
Apply AI tools such as Codex, Claude, and Gemini to improve SOC processes, alert triage, and investigations, with appropriate human review and data-handling controls.
Align detections to frameworks such as MITRE ATT&CK.
Partner with Vulnerability Management, Security Engineering, Detection Engineering, Risk Management, IT, Compliance, and business units.
Work with external partners, including law enforcement, industry peers, and managed security vendors, as needed.
Lead and collaborate on Purple Teaming exercises to improve security posture.