SOC Manager

ECS Federal•Work from home, VA

About The Position

ECS is seeking an experienced SOC Manager to lead analysts supporting its 24x7x365 managed security operations. The role is responsible for the people, processes, and operational execution needed to provide consistent, high-quality detection, investigation, escalation, and incident response across multiple customer environments. The SOC Manager is both a people leader and a senior operational escalation point, managing competing customer priorities and making decisions during high-severity cybersecurity events. The position works across security disciplines and customer teams to improve detection and response capabilities, strengthen operational processes, and continuously improve SOC services. It also supports customer onboarding and operational readiness, develops operational reporting and improvement recommendations, and participates in an after-hours management and incident escalation rotation as required. Periodic travel to ECS or customer locations may be required.

Requirements

8+ years of cybersecurity experience, with significant experience in Security Operations, Incident Response, Threat Detection, Threat Hunting, Detection Engineering, Cyber Threat Intelligence, or related cyber defense functions.
Prior people-management experience in a SOC, MDR, MSSP, or comparable cyber defense environment, including coaching, performance management, skills development, staffing, and operational accountability.
Strong understanding of modern security operations and incident investigation across endpoint, identity, network, email, cloud, SaaS, and hybrid environments.
Experience with enterprise SIEM and EDR/XDR technologies, such as Microsoft Sentinel, Splunk, Elastic Security, Microsoft Defender XDR, CrowdStrike Falcon, Trellix, SentinelOne, or equivalent platforms.
Experience with SOAR, security automation, case management, or AI-assisted security operations technologies.
Experience investigating security activity involving Microsoft 365, Microsoft Entra ID, Azure, AWS, cloud workloads, SaaS applications, or other cloud and identity environments.
Strong understanding of contemporary attacker methodologies and attack lifecycles, including threat actor tactics, techniques, and procedures, identity-based attacks, ransomware, account compromise, business email compromise, and cloud attacks.
Experience applying MITRE ATT&CK to investigations, detections, threat hunting, or measurement of defensive coverage.
Demonstrated ability to lead operational response during cybersecurity incidents and coordinate across technical teams, customers, and organizational stakeholders.
Experience developing, implementing, or improving SOC processes, playbooks, runbooks, escalation procedures, and investigative standards.
Strong understanding of SOC performance measurement, including investigation quality, SLA performance, response timelines, detection effectiveness, alert fidelity, workload, and escalation trends.
Excellent written and verbal communication skills, including the ability to communicate complex cybersecurity issues to analysts, engineers, customers, executives, and non-technical stakeholders.
Strong problem-solving, judgment, and decision-making skills, particularly during ambiguous, time-sensitive, or high-impact security events.
Ability to independently manage competing personnel, customer, incident, and operational priorities while maintaining accountability for service delivery and outcomes.
U.S. citizenship and ability to obtain and maintain a Secret security clearance.
Ability to travel periodically to ECS or customer locations as business requirements dictate.

Responsibilities

Lead and manage SOC analysts, including recruiting, staffing, scheduling, workload management, onboarding, coaching, performance management, technical development, retention, and career development.
Maintain effective 24x7x365 SOC coverage, including shift coverage, workload distribution, escalation coverage, leave coordination, and identification of coverage or skills gaps.
Maintain accountability for the quality, consistency, and timeliness of investigations, escalations, customer communications, and operational deliverables.
Serve as a senior operational escalation point for complex investigations, customer issues, high-severity incidents, and matters requiring management judgment or cross-team coordination.
Manage security operations across multiple customer environments with differing technology stacks, security requirements, escalation procedures, and service-level commitments.
Monitor SOC performance metrics, including alert volume, investigation and response timelines, escalation trends, SLA attainment, detection quality, false-positive rates, case quality, and analyst workload.
Identify operational bottlenecks and drive measurable improvements through process refinement, detection tuning, automation, AI-assisted workflows, analyst enablement, and technology integration.
Ensure SOC playbooks, runbooks, standard operating procedures, escalation paths, and investigative standards are documented, maintained, followed, and improved.
Coordinate operational incident response and review complex investigations for appropriate scope, technical accuracy, escalation, containment recommendations, documentation, customer communication, and transition to Incident Response resources when needed.
Maintain working knowledge of security operations technologies used across customer environments and ensure personnel can investigate activity across endpoint, identity, network, email, cloud, SaaS, and hybrid environments.
Partner with Detection Engineering, Cyber Threat Intelligence, Threat Hunting, Incident Response, Red Team, Security Engineering, and SOAR/Automation teams to improve detection coverage, alert fidelity, investigation workflows, and response capabilities.
Incorporate emerging threats, adversary tactics, techniques, and procedures, MITRE ATT&CK, incident lessons learned, threat hunting results, and analyst feedback into operational priorities.
Support responsible adoption of AI-assisted security operations for triage, investigation, enrichment, summarization, workflow automation, and analyst decision support, with appropriate human oversight and accountability.
Support customer onboarding and operational readiness, including processes, escalation paths, telemetry availability, detection readiness, reporting requirements, and analyst enablement.
Build working relationships with customer security and IT teams, technical stakeholders, and leadership; participate in customer operational reviews, incident calls, service reviews, and escalations as required.
Develop and present operational reporting, dashboards, incident summaries, service metrics, risks, trends, and improvement recommendations to technical and leadership audiences.
Participate in an after-hours management and incident escalation rotation as required.
Perform other duties as assigned.