SOC Manager

Peraton is seeking a SOC Manager. Peraton’s Defense Mission and Global Health Solutions Sector is seeking a for the Department of Defense (DoD).  The successful candidate will be responsible for the overall management and operation of the Security Operations Center (SOC), ensuring the effective detection, analysis, and response to cybersecurity incidents. Lead and manage a team of SOC analysts, providing guidance on incident detection, triage, and escalation procedures. Develop and maintain SOC procedures, playbooks, and training materials to improve the team's effectiveness and efficiency. Oversee the continuous monitoring of security systems and networks, ensuring the timely identification and response to security alerts. Manage and coordinate response activities, working with internal and external stakeholders to mitigate and eliminate cyber threats. Responsible for ensuring Government is informed on all SOC-related events.

What You’ll Do:

• SOC Management and Operations Oversight: Oversee the daily operations of the Security Operations Center (SOC), ensuring the effective execution of cybersecurity monitoring, detection, response, and reporting activities.
• Team Leadership and Mentorship: Lead and manage a team of SOC analysts, providing guidance, mentorship, and support on incident detection, triage, escalation, and mitigation processes. Conduct performance assessments and identify professional development opportunities for SOC team members.
• Incident Detection and Analysis: Monitor and analyze cybersecurity events to identify anomalies, threats, and potential compromises using security tools such as SIEM, IDS/IPS, and EDR solutions. Identify and report on indicators of compromise (IOCs) while adhering to established escalation protocols.
• Incident Response Coordination: Manage and coordinate incident response activities, including containment, eradication, and recovery, while ensuring proper documentation of actions. Collaborate with internal stakeholders (e.g., IT teams, system owners) and external constituents (e.g., vendors, law enforcement, or intelligence agencies) during incident response efforts.
• SOC Policies and Playbook Development: Develop, review, and maintain SOC standard operating procedures (SOPs), playbooks, and runbooks to streamline incident response and escalation processes. Ensure all SOC-related documentation reflects current threats and technologies.
• Security Systems and Network Monitoring: Oversee continuous monitoring of networks, systems, and endpoints to identify and respond to security alerts in a timely manner.  Optimize security tool configurations and automated workflows to improve threat detection capabilities.
• Risk and Threat Management: Evaluate security posture by analyzing threat intelligence, attack patterns, and system vulnerabilities to identify and mitigate weak points in the organization’s defense.  Lead efforts to improve SOC detection and response capabilities by evaluating and adopting cutting-edge tools and processes.
• Security Event Reporting to Government Stakeholders: Ensure timely reporting of all SOC-related events, incidents, and threat intelligence findings to government leadership and stakeholders.  Provide actionable recommendations to address vulnerabilities, mitigate threats, and strengthen cybersecurity postures.
• Training and Cybersecurity Awareness Initiatives: Conduct SOC team training to improve response techniques, threat-hunting abilities, and awareness of emerging cyber threats and vulnerabilities.  Promote cybersecurity awareness and defensive best practices across the organization.
• Continuous Improvement and Post-Incident Review: Lead post-incident reviews to evaluate the effectiveness of the SOC response, identify lessons learned, and integrate improvements into future operations. Provide feedback to leadership on SOC performance metrics and resources needed for optimization.

Required Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD
• Must be a US Citizen
• Clearance Requirement: Top Secret
• CompTIA Security+
• Certified Information Systems Security Professional (CISSP)

Desired Qualifications

• Certified Ethical Hacker (CEH)
• GIAC Certified Incident Handler (GCIH)
• GIAC Security Operations Certified (GSOC)
• CompTIA Advanced Security Practitioner (CASP+)
• Certified Information Security Manager (CISM)
• AWS Certified Security – Specialty or Microsoft Certified: Azure Security Engineer Associate: Relevant if managing systems in hybrid or cloud environments.
• Cyber Threat Intelligence (CTI) Cert or MITRE ATT&CK™ Defender (MAD)
• Demonstrates specialized knowledge in threat intelligence analysis and mapping frameworks.
• Advanced Threat Intelligence Knowledge. Experience working with and integrating threat intelligence platforms and frameworks into SOC operations.
• Automation and Scripting Skills. Knowledge of scripting languages like Python, PowerShell, or Bash for automating routine SOC tasks and custom threat detection rules.
• Strategic Thinking and Risk Management. Ability to assess current threats and vulnerabilities, prioritize organizational risks, and drive proactive mitigation strategies.
• Strong interpersonal and communication skills to relay real-time incident updates and foster collaboration between SOC teams and other organizational units.
• Experience with Federal and DoD Systems: Familiarity with compliance requirements and operational environments specific to the Department of Defense (e.g., DISA STIGs, FedRAMP, RMF).