Agile Defense is seeking a Security Operations Center Manager to run the security operations center supporting U.S. Customs and Border Protection. The role owns the SOC's people, process, and performance, works across insider threat, threat hunting, incident response, forensics, and vulnerability assessment, and provides accurate performance and risk reporting to leadership. The position is hybrid, 3 to 5 days onsite in Reston, VA, with a salary range of $155,000-$185,000.
Responsibilities
Own the SOC's people, process, and performance; oversee how alerts get triaged and how work gets prioritized; manage the SOC as a whole rather than as a collection of individual analysts; work closely with leads of insider threat monitoring, threat hunting, incident response, digital forensics, and vulnerability assessment; ensure alert volume is triaged fast enough that real incidents are not queued behind noise; ensure analysts have written escalation and closure standards; tune out recurring false positives at the source; ensure specialist functions hand off work cleanly; ensure coverage across shifts and staffing gaps; provide leadership with accurate reporting on SOC performance and program exposure; escalate risk requiring decisions above the role's level in time to act; communicate incident severity and impact accurately the first time; build lessons learned into SOC operations; develop analysts' skills; maintain standards and playbooks for recurring SOC work
Requirements
Active Top Secret with SCI Eligibility, or ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD; U.S. Citizenship required; CISSP required; one of GCFA, GREM, GCIH, OSCP, GPEN, GFCE or equivalent preferred; minimum of five (5) years of direct operational and program management experience in delivery of Cybersecurity program or related projects; minimum of seven (7) years of professional experience with a solid understanding of incident response, insider threat investigations, digital forensics, and cyber threats; minimum of five (5) years of cybersecurity experience, with at least 5 years in a SOC leadership capacity; in-depth technical expertise in SIEM, EDR, and incident response methodologies; thorough understanding of network architectures and security controls; ability to create insider threat focused dashboards, reports and workflow diagrams; experience collecting data, chain of custody and reporting results; experience handling and escalating security issues or emergency situations; experience providing incident response capabilities to isolate and mitigate threats; experience mentoring junior members in an open collaborative environment; Bachelor's degree in computer science, engineering, STEM or cybersecurity; one of the following certifications: GCFA, GREM, GCIH, OSCP, GPEN, GFCE or equivalent preferred
Nice to have
Experience running a security operations center or an equivalent detection and response function; experience managing a team through a real incident; experience reporting security posture and incidents to non-technical leadership; experience working inside a federal or highly regulated security program; active CBP BI, a fitness determination at another DHS component, or an active DoD clearance; comfort across insider threat, threat hunting, incident response, forensics, and vulnerability assessment; certifications such as CISSP, GCIH, or CISM
Benefits
Health Insurance; Life Insurance; Paid Time Off; Holiday Pay; short-term and long-term Disability; Retirement; Learning and Development opportunities; other optional benefit elections; $10,000 signing bonus for candidates with an active CBP BI, payable after 90 days under standard terms
Stany Zjednoczone · Reston
