SOC Operations Architect / Senior SOC Lead

About US:
Tryfacta is a leading, nationally renowned Workforce Management Solution provider for private &public sector firms across the US. We specialize in Healthcare, IT, Business Support, and Professional & Craft/Light Industrial ecosystems.

Founded in March 1996, we have a presence in all 50 States. Tryfacta has Ranked number 1 as one of the fastest-growing companies by Inc. Magazine (Inc. 5000)!

Tryfacta is certified by the Joint Commission for Healthcare Staffing Services & has numerous ISO Certifications that capture our commitment to continuous improvement.

Job Summary:
Tryfacta is seeking a SOC Operations Architect / Senior SOC Lead for our client in Long Beach, CA, 90802. This is a temporary contract assignment. If you meet the qualifications listed below and are interested, please Apply Now!

Job Diva ID: 26-04950
Position Title: SOC Operations Architect / Senior SOC Lead
Location: Long Beach, CA, 90802
Duration: 6 months
Work location: Remote
Candidate location: Candidate must be located in California
Work Schedule: Monday through Friday, 8:00 a.m. to 5:00 p.m.

Responsibilities for this position include, but are not limited to:

• Develop and refine SOC workflows covering monitoring, detection, alert triage, investigation support, escalation, and campus handoff.
• Review vendor operating processes, technical designs, integrations, workflows, and implementation assumptions.
• Identify technical or operational gaps, unclear ownership, responsibility concerns, and implementation risks.
• Help determine whether requirements should be addressed by the vendor, the CFC, individual campuses, or another CSU dependency.
• Validate monitoring use cases, detection rules, alert quality, reporting, and operational metrics.
• Review baseline telemetry from identity, endpoint, firewall, VPN, IDS/IPS, and related security sources.
• Create and update SOC runbooks, severity mapping, escalation logic, and incident coordination procedures.
• Support pilot readiness through workflow testing, tabletop exercises, scenario validation, issue tracking, and identification of operational gaps.
• Coordinate with CFC leadership, vendor staff, campus security teams, and project partners on response ownership, escalation expectations, handoffs, and feedback loops.

To be considered for this position, you should have:

Required Qualifications

• Senior-level experience in security operations, SOC operations, incident response, detection engineering, security architecture, or a related cybersecurity operations role.
• Strong technical knowledge of SOC architecture and service integration, including telemetry flows, SIEM and platform integration, identity correlation, access models, alert lifecycles, and ITSM integration.
• Experience overseeing MSSP, MDR, SOC, SIEM, or cybersecurity vendors.
• Experience reviewing vendor designs and deliverables, challenging assumptions, clarifying responsibility boundaries, and identifying service or implementation gaps.
• Experience establishing, transitioning, or maturing security operations capabilities.
• Hands-on experience developing or operating SOC workflows, including alert triage, escalation, investigation, incident handoff, and response coordination.
• Strong knowledge of incident severity models, escalation criteria, detection use cases, and security operations metrics.
• Experience creating runbooks, procedures, playbooks, workflow diagrams, or similar operational documentation.
• Experience with SIEM, EDR, identity, firewalls, VPN, IDS/IPS, and related security telemetry sources.
• Strong documentation and communication skills, with the ability to work effectively with technical teams, vendors, campuses, and leadership stakeholders.
• Experience in higher education, public-sector, federated, or other multi-entity environments is preferred but not required.

Tryfacta is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran or disabled status, or genetic information.