SITEC - SOC Manager - MacDill AFB

Peraton requires a SOC Manager to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM.  This position is located at MacDill AFB in Florida.

The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. 

The SOC Manager serves as the senior operational authority responsible for directing, synchronizing, and executing enterprise-wide Defensive Cyber Operations (DCO). This role provides end-to-end operational leadership and oversight across the entire cyber defense lifecycle, leading three integrated operational pillars: SOC Tier 1 (24/7/365 Real-time Triage & Sensor Health Monitoring), SOC Tier 2 (Deep Incident Response, Containment & Detection Engineering), and SOC Tier 3 (Proactive Threat Hunting, Cyber Threat Intelligence [CTI], and Digital Forensics). The SOC Manager is accountable for establishing standardized defensive doctrine, enforcing rigorous Service Level Agreements (SLAs), driving cross-tier operational synergy, and directing high-tempo incident response during major cyber security crises. By aligning cyber threat intelligence, advanced engineering, and rapid tactical response, the SOC Manager ensures the resilience and defense of mission-critical enterprise networks against sophisticated Advanced Persistent Threat (APT) actors.

• Direct, orchestrate, and synchronize operations across all three SOC operational tiers—SOC 1 (Frontline Triage & Health), SOC 2 (IR & Detection Engineering), and SOC 3 (Threat Hunt, CTI & Forensics)—ensuring seamless cross-functional workflows, shared situational awareness, and end-to-end defensive efficacy.
• Monitor, and enforce operational KPIs and metrics (e.g., MTTA, MTTD, MTTR, false-positive ratios, hunt efficacy, detection health) across all tiers to ensure compliance with enterprise SLAs, mission requirements, and cyber defense mandates.
• Direct the operational integration of Cyber Threat Intelligence (CTI) into proactive hunting campaigns and detection pipelines; ensure SOC 3 hunt findings and intelligence products directly drive SOC 2 detection engineering and SOC 1 triage refinement.
• Guide the strategic implementation of Detection-as-Code (DaC), SIEM correlation rules (e.g., Splunk/Sentinel), and SOAR automated playbooks to streamline analyst workflows, accelerate containment, and eliminate systemic blind spots mapped against the MITRE ATT&CK framework.
• Author, review, and maintain standardized DCO doctrine, Incident Response Plans (IRPs), Concept of Operations (CONOPS), and operational runbooks across all tiers to guarantee repeatable, audit-compliant execution.
• Drive recruitment, retention, technical training paths, and 24/7/365 staffing allocations across all teams; organize regular purple team exercises, red team simulations, and tabletop drills to evaluate and enhance defensive readiness.
• Partner with enterprise architecture and engineering leads to evaluate, resource, and integrate cutting-edge security technologies (SIEM, SOAR, EDR, NDR, TIP) into the unified operational fabric of the SOC.

Required Qualifications:

• Minimum 12 years of experience
• DoD 8570 IAT II Certification  
• DoW TS/SCI clearance
• Must be DoW 8140 compliant under the Work Role Code 531– Cyber Defense Incident Responder - Advanced level 

Desired Qualifications:

• Strong analytical and problem-solving skills
• Ability to communicate security issues clearly to both technical and non-technical stakeholders
• 5+ years of technical experience with cyber tools and TTPs
• Experience managing a SOC or team of cyber professionals