Sr. Security Operations Center Manager

Global Medical Response•Greenwood Village, CO

2d•Hybrid

About The Position

Under the guidance of the Chief Information Security Officer (CISO) and Director of Cyber Security Operations, the Senior Security Operations Center (SOC) Manager is responsible for the day-to-day defense of the enterprise and the operational readiness of the SOC. Working closely with Cyber Security, Infrastructure, Cloud, and business partners, this leader oversees threat monitoring, detection, response, and incident management while ensuring effective team performance and continuous improvement. The Senior SOC Manager leads the Security Operations Center, directs detection and response activities, and serves as incident commander during significant security events. This hands-on leadership role requires technical expertise, strategic vision, and the ability to build high-performing teams, foster cross-functional partnerships, mature security operations, and translate complex cyber risk into actionable business decisions.

Requirements

Bachelor's degree in Computer Science, Information Security and Risk Management, Information Systems, Engineering, or a related discipline. Six years of security-related experience may be substituted for the degree.
Minimum eight years of information security experience.
Minimum three to five years leading security operations, incident response, detection engineering, or threat management teams.
Experience operating in highly regulated environments such as Healthcare, Financial Services, Government, or Defense preferred.
Experience managing MDR, MSSP, or co-managed SOC relationships and security vendors.
Experience in healthcare, EMS, aviation, or another mission-critical or safety-of-life environment preferred.
Strong incident response, threat detection, threat management, and security operations expertise.
In-depth understanding of cyber threats, attack techniques, threat actors, risk management, and incident management principles.
Working knowledge of Windows, Linux, Unix, cloud platforms, identity technologies, and modern enterprise security architectures.
Ability to develop meaningful metrics, dashboards, documentation, and executive-level communications.
Demonstrated leadership and stakeholder management skills, including the ability to build and retain high-performing teams, influence across organizational boundaries, resolve conflict, and communicate effectively with technical and executive audiences.
Strong collaboration and partnership skills, with a proven ability to establish trust and shared ownership across Cyber Security, Infrastructure, Engineering, Compliance, and business teams.
Experience leading enterprise-wide security incidents involving multiple technology and business stakeholders.
Experience developing security operations strategy, roadmaps, and operational maturity programs while balancing tactical demands with long-term objectives.

Nice To Haves

CISSP preferred.
SSCP, CySA+, GCIH, or comparable certifications preferred.
Relevant certification or demonstrated equivalent expertise preferred.

Responsibilities

Own the 24x7x365 operational security posture of the enterprise, including monitoring, shift coverage, escalation, handoff quality, and operational readiness.
Lead, coach, and develop SOC personnel while fostering accountability, teamwork, continuous learning, mutual respect, and operational excellence. Manage hiring, performance, career development, and retention.
Establish and enforce service levels for triage, investigation, incident response, and escalation across alert severity tiers.
Serve as the senior operational authority during security incidents, including after-hours events and major business disruptions.
Build trusted partnerships across Infrastructure, Cloud, Identity, Network, Applications, Compliance, and business teams to improve security outcomes and organizational resilience.
Mentor analysts, engineers, and emerging leaders while maintaining career development and succession plans for key security roles.
Direct monitoring across endpoint, network, identity, email, cloud, and SaaS telemetry.
Own the incident response lifecycle end to end, including detection, triage, containment, eradication, recovery, and after-action review.
Act as incident commander for high-severity events and lead root cause analysis, ensuring corrective actions are assigned, tracked, and completed.
Maintain and exercise incident response plans, playbooks, and communication procedures.
Own detection content quality, including MITRE ATT&CK coverage mapping, alert tuning, and retirement of low-value detections.
Reduce manual effort through automation, orchestration, and responsible adoption of AI-assisted security capabilities, and measure the resulting improvement.
Partner with engineering and infrastructure teams to close logging, telemetry, and visibility gaps.
Continuously improve detection capabilities through threat intelligence, threat modeling, adversary emulation, purple team exercises, and lessons learned from security events, with emphasis on threats relevant to healthcare, EMS, and aviation operations.
Measure detection effectiveness against evolving threats and industry best practices.
Establish proactive threat hunting capabilities to identify and disrupt malicious activity before alert-driven detection.
Support HIPAA Security Rule obligations, including breach assessment inputs and evidence requests for the Privacy Office.
Support CMMC and DoD requirements applicable to federal programs and contracts.
Support SOX IT general controls and audit evidence requests in a public-company environment.
Coordinate with clinical, aviation, and ground and fleet stakeholders on risks affecting connected medical devices, dispatch and CAD systems, ePCR platforms, and operational technology.
Manage MDR, MSSP, and security technology vendor relationships, including performance against contractual service levels.
Partner with the Director of Cyber Security Operations on SOC budget planning, capacity forecasting, and headcount justification.
Evaluate, recommend, and optimize security technologies and operational capabilities, retiring tools that do not provide sufficient value.
Deliver monthly and quarterly SOC metrics and risk reporting that non-technical executives can act on.
Provide clear, concise, and factual status during active incidents, without presenting speculation as fact.
Translate complex technical risks into actionable business decisions and build consensus while balancing security, operational, and business priorities.
Contribute to board, audit committee, regulatory, and executive reporting through Cyber Security leadership.