SOC Project Manager – SOC Lead (Secret Clearance)

ShorePoint•Washington, DC

2d•Onsite

About The Position

ShorePoint is seeking a SOC Project Manager – SOC Lead to lead and manage all Security Operations Center functions. The SOC Lead ensures unified service delivery across sub-task areas, provides operational direction, and influences executive leadership to align security operations with enterprise objectives. The role requires deep expertise in SOC management, incident response, and hybrid on-premises/cloud environments. The position leads a 24x7x365 SOC for unclassified environments, overseeing shift coverage, on-call incident-response support, coordination across task areas, and integration of on-premises and cloud capabilities. It also manages dedicated business-hours coverage for specific customer offices, including staggered shift scheduling. The SOC Lead ensures operations follow the full NIST Cybersecurity Framework and serves as, or directs, the Incident Commander for significant incidents. The role oversees incident coordination, federal reporting, SOC consolidation and customer onboarding, procedures and playbooks, performance metrics, knowledge management, AI-enabled analytics and security automation, and staff training. The position is onsite in Washington, DC, and applicants must hold and maintain an active Secret clearance.

Requirements

Bachelor’s degree, or at least 3 additional years of relevant experience in lieu of a degree.
At least 10 years managing SOC operations and incident response for enterprise environments with 50,000 or more endpoints.
At least 5 years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.
Active Secret clearance that the applicant can maintain.
Strong cybersecurity incident-response background across large, complex enterprise environments.
Proven ability to align SOC functions with the NIST Cybersecurity Framework.
Experience coordinating subordinate managers and technical leads to deliver cohesive operations.
Skill influencing executive leadership and driving organizational adoption of SOC best practices.
Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.
Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII), and vulnerability tools (Tenable, Qualys).
Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention, and escalation structures.
Familiarity with federal incident-reporting requirements and OMB M-21-31 event logging maturity.
Ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.

Nice To Haves

One or more active certifications: CISSP, GCIH, GCIA, GSOM, or CISM.
Experience integrating multiple organizations into a consolidated SOC.

Responsibilities

Lead a 24x7x365 SOC for unclassified environments.
Ensure shift managers and escalation contacts cover every shift and that on-call incident-response support is available.
Coordinate task execution across sub-task leads to achieve enterprise-level objectives.
Oversee integration and coordination of on-premises and cloud-based SOC capabilities.
Communicate SOC performance and posture to executive leadership and stakeholders.
Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover.
Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.
Serve as, or direct, the Incident Commander for significant and widespread incidents; lead incident calls, coordinate response across teams and task orders, manage government notifications and stakeholder communications, and track after-action items through remediation.
Direct task order incident coordinators within each sub-task area.
Ensure playbook adherence and complete incident lifecycle documentation in the ticketing system.
Oversee required reporting to federal oversight bodies, the Inspector General, and law enforcement, including reporting classified spills onto unclassified systems.
Coordinate with interagency and intelligence community partners such as CISA, the FBI, and DHS.
Lead operational SOC consolidation, including onboarding customer organizations’ log sources and alerting, standardizing detection logic, escalation protocols and playbooks, and transitioning organizations into steady-state operations and maintenance.
Develop and maintain SOPs, incident-response playbooks, an alert severity and triage framework, and standardized reporting templates.
Own SOC performance metrics, including mean time to detect, mean time to respond, alert volumes, false-positive rates, ticket-closure rates, and SLA compliance; explain deviations and propose corrective actions.
Build a centralized incident knowledge base and lessons-learned repository shared across customer organizations.
Lead adoption of AI-enabled analytics and next-generation security automation.
Train SOC staff on operating procedures and ensure analysts maintain tool proficiency.