SOC Team Lead

Location: Onsite – New Carrollton, MD or Memphis, TN

Terms: Full-time

Salary: $130K - $160K DOE

Clearance: Public Trust

Travel: 0% (onsite presence at client facilities as directed)

Position Description

We are seeking a SOC Team Lead to serve as task lead for incident report acceptance and coordination in a 24x7x365 Security Operations Center (SOC) supporting a large federal agency. This seasoned technical contributor receives, reviews, documents, and coordinates reports of suspicious cyber activity and potential cybersecurity incidents from authorized sources, leads the analysts performing this work, and develops solutions to technical problems that may be difficult and unclear in collaboration with internal experts.

The successful candidate will:

• Lead the team that receives and coordinates incoming incident reports.
• Ensure every reported incident is accurately recorded, routed, and escalated on time.
• Keep incident records complete through closure.
• Coordinate incident handling across SOC functions and partner organizations.

Responsibilities:

• Serve as task lead for incident report acceptance and coordination, assigning and reviewing the work of SOC analysts.
• Receive, review, document, and coordinate reports of suspicious cyber activity or potential incidents from authorized sources, including internal personnel, organizational components, other contractors, third-party service providers, CISA, and partner SOCs.
• Monitor approved communication channels for incoming incident reports, suspicious activity reports, and situational awareness updates.
• Record, validate, and update incident information in approved tracking systems.
• Refer potential incidents to appropriate SOC personnel, client stakeholders, or other authorized parties for further review or action.
• Coordinate incident handling activities across relevant SOC functions under client direction.
• Maintain incident documentation, including actions taken, findings, timelines, and escalation history.
• Escalate incidents, issues, and required decisions to the client SOC team in accordance with established procedures.
• Support required incident reporting in accordance with organizational, contractual, and regulatory guidance.
• Verify that incident records contain sufficient information to support closure only after required remediation, coordination, and reporting have occurred.

Required Skills and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field and 7+ years of relevant professional experience; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• Seasoned technical individual contributor, fully proficient in applying technical principles, theories, and concepts in the field.
• Ability to develop solutions to technical problems and issues that are difficult, unclear, and require deep technical knowledge.
• Deep understanding of the principles, theories, and concepts of the technical domain, with broad understanding of related specialty areas.
• Experience with SOC incident intake, ticketing, and case management in a large enterprise.
• Working knowledge of NIST SP 800-61 and federal incident reporting requirements.
• Experience leading a team or serving as a task lead, including assigning work, reviewing quality, and reporting status to client leadership.
• Experience leading a team or serving as a task lead, including assigning work, reviewing quality, and reporting status to client leadership.

Desired

• Experience supporting federal government contracts as a contractor, including working to contract performance standards, deliverable schedules, and government review and approval processes.
• Certifications such as GCIH, CySA+, or CISSP.
• Experience with SIEM and SOAR platforms.
• Experience coordinating with CISA and partner SOCs.

Work Authorization/Clearance: Must be a U.S. Citizen and able to obtain a Public Trust clearance.