SOC Project Manager – SOC Lead (Secret Clearance)

Who we are:

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a “work hard, play hard” mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.

The Perks:

As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual’s technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more.

Who we’re looking for:

We are seeking a SOC Project Manager – SOC Lead (Secret Clearance) to lead and manage all Security Operations Center functions. The SOC Lead will ensure unified service delivery across sub-task areas, provide operational direction and influence executive leadership to align security operations with enterprise objectives. The SOC Project Manager – SOC Lead role requires deep expertise in SOC management, incident response and hybrid on-premises/cloud environments. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

What you’ll be doing:

Lead a 24x7x365 SOC for unclassified environments. Ensure shift managers and escalation contacts cover every shift and on-call support is available for incident response.

Coordinate task execution across sub-task leads to achieve enterprise-level objectives.

Oversee the integration and coordination of on-premises and cloud-based SOC capabilities.

Communicate effectively with executive leadership and stakeholders on SOC performance and posture.

Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond and Recover.

Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.

Serve as, or direct, the Incident Commander for significant and widespread incidents. Responsibilities include:

leading incident calls

coordinating response across all teams and task orders

managing government notifications and stakeholder communications

tracking after-action items through remediation

Direct the task order incident coordinators within each sub-task area. Ensure playbook adherence and full incident lifecycle documentation in the ticketing system.

Oversee required reporting to federal oversight bodies, the Inspector General and law enforcement. Oversee reporting of classified spills onto unclassified systems.

Coordinate with interagency and intelligence community partners such as CISA, the FBI and DHS.

Execute the operational side of SOC consolidation:

onboarding new customer organizations’ log sources and alerting

standardizing detection logic, escalation protocols and playbooks

transitioning onboarded organizations into steady-state operations and maintenance

Develop and maintain SOPs, incident response playbooks, an alert severity and triage framework, and standardized reporting templates.

Own SOC performance metrics: mean time to detect, mean time to respond, alert volumes, false positive rates, ticket closure rates and SLA compliance. Explain any deviations and propose corrective actions.

Build a centralized incident knowledge base and lessons-learned repository that is shared across customer organizations.

Lead adoption of AI-enabled analytics and next-generation security automation.

Train SOC staff on operating procedures and ensure analysts maintain tool proficiency.

What you need to know:

Strong background in cybersecurity incident response across large, complex enterprise environments.

Proven ability to align SOC functions with the NIST Cybersecurity Framework.

Experience coordinating subordinate managers and technical leads to deliver cohesive operations.

Skilled at influencing executive leadership and driving organizational adoption of SOC best practices

Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.

Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII) and vulnerability tools (Tenable, Qualys).

Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention and escalation structures.

Familiarity with federal incident reporting requirements and OMB M-21-31 event logging maturity.

Must have’s:

Bachelor’s degree or 3+ additional years of relevant experience in lieu of degree.

10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints), including 5+ years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.

Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.

Applicants must hold and maintain an active Secret clearance.

Beneficial to have the following:

Hold one or more of the following active certifications: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Manager (GSOM), or Certified Information Security Manager (CISM).

Experience integrating multiple organizations into a consolidated SOC.

Where it’s done:

Onsite (Washington, DC).