Senior Technical Lead, Cybersecurity Operations Center (COC)

CAI•Chicago, IL

23h•$150,000 - $160,000•Onsite

About The Position

As a Senior Technical Lead, Cybersecurity Operations Center (COC) you will evaluate our client's current SOC organization, processes, and technology tools and rebuild/ optimize it. We are looking for a Senior Technical Lead, Cybersecurity Operations Center (COC) to manage the deployment, ongoing tuning, configuration, and operation of managed detection and response (MDR) tools and services, endpoint detection solutions, software logging and scanning tools, and other cybersecurity solutions while overseeing security event, incident, and vulnerability assessment and remediation efforts. The Senior Technical Lead, Cybersecurity Operations Center (COC) will evaluate our client's current COC Organization, process and technology tools, making recommendations to optimize and rebuild. This position will be a full-time 4-6 month contract and onsite in the Chicago loop. There is no relocation for this position, local candidates only. This position requires the incumbent to be onsite in Chicago onsite initially 5-days per week with the possibility of going hybrid after 3-months. Due to our end client, only US Citizens will be considered for this role.

Requirements

Bachelor's degree in Information Technology, Engineering, Management Information Systems, or a related field or four years of equivalent experience in IT networking or cybersecurity in lieu of a degree
Eight years of experience in IT networking or cybersecurity including six years of experience as a security analyst, network engineer, or systems engineer
Recent and practical hands-on experience in the following MS stack: EntraID, Defender (cloud, endpoint, email) and Sentinel
Two years of cybersecurity operations team leadership experience
Considerable knowledge of security event monitoring, analysis, triage, vulnerability scanning, asset management, and MDR/SIEM tools and processes
Considerable knowledge of PCs, servers, firewalls, TCP/IP, network administration tools, intrusion detection systems, anti-virus software, Active Directory, data encryption, and security best practices
Knowledge of cybersecurity frameworks and methodologies including NIST 800-53, ISO 27001, MITRE ATT&CK, and CIS Controls
Strong problem-solving skills with the ability to balance business requirements and cybersecurity risk
Strong program and project management skills
Strong verbal and written communication skills with the ability to engage effectively with vendors and stakeholders at all organizational levels
Strong organizational, analytical, and critical thinking skills to evaluate cybersecurity controls and recommend improvements
Ability to build and lead high-performing teams through clear direction, accountability, and results-driven leadership
Ability to evaluate cybersecurity control effectiveness, recommend security improvements, build consensus, and facilitate execution
Ability to prioritize and execute tasks in a high-pressure environment while balancing risk and business needs
Ability to collaborate effectively with IT teams, business users, and external partners to deliver secure technology solutions

Nice To Haves

Experience standing up a COC
CISM
CISSP
CompTIA Security+

Responsibilities

Analyze our client's current state COC organization, technology and operational process environment. Define process/ procedure, organizational gaps
Define future state COC organization (roles and responsibilities, current staff alignment, skills gaps), processes (event triage, playbook), and technology (note: the client does not want to implement new technology, but if there is a vision to eliminate redundancy and/or an opportunity to consolidate then there should be recommendations)
Gain an understanding our client's current state infrastructure, how to tune, identify redundancies and basically teach the team what it all means so they can be effective in their COC
Manage the deployment, ongoing tuning, configuration, and operation of managed detection and response (MDR) tools and services, endpoint detection solutions, software logging and scanning tools, and other cybersecurity solutions to ensure cybersecurity health
Oversee the assessment and remediation of all security events, incidents, and vulnerabilities identified by the security operations team
Collaborate with IT teams and business stakeholders to establish expectations, develop security strategies, build consensus on remediation plans, and facilitate implementation
Create, refine, test, and enforce cybersecurity policies and procedures to identify security gaps and remediation actions
Develop and maintain disaster recovery plans and coordinate organizational readiness for disruptive events and business continuity
Implement cybersecurity awareness and training programs that educate employees on recognizing, responding to, and reporting cybersecurity threats
Monitor emerging cybersecurity threats, vulnerabilities, industry best practices, and regulatory requirements to ensure compliance and continuous improvement
Provide expertise and guidance on security data analysis methodologies and collaborate with cross-functional teams to enhance detection and response capabilities
Recommend strategies to reduce security risks across cloud environments, on-premises infrastructure, servers, network devices, and endpoint systems
Review, update, communicate, and execute incident response plans while coordinating exercises and ensuring stakeholders understand their responsibilities