Who we are:
ShorePoint is a fast-growing, industry recognized and award-winning cybersecurity services firm with a focus on high-profile, high-threat, private and public-sector customers who demand experience and proven security models to protect their data. ShorePoint subscribes to a “work hard, play hard” mentality and celebrates individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers. We are equally passionate about an environment that supports creativity, accountability, diversity, inclusion and a focus on giving back to our community.
The Perks:
As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individuals technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, including major carriers for health care providers. Highlighted benefits offered: 18 days of PTO, 11 holidays, 85% of insurance premium covered, 401k, continued education, certifications maintenance and reimbursement and more.
Who we’re looking for:
We are seeking a SOC Project Manager - SOC Lead (Secret Clearance) to lead and manage all Security Operations Center functions. The SOC Lead will ensure unified service delivery across sub-task areas, provide operational direction and influence executive leadership to align security operations with enterprise objectives. The SOC Project Manager - SOC Lead role requires deep expertise in SOC management, incident response and hybrid on-premises/cloud environments. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.
What you’ll be doing:
- Lead a 24x7x365 SOC for unclassified environments. Ensure shift managers and escalation contacts cover every shift and on-call support is available for incident response.
- Coordinate task execution across sub-task leads to achieve enterprise-level objectives.
- Oversee the integration and coordination of on-premises and cloud-based SOC capabilities.
- Communicate effectively with executive leadership and stakeholders on SOC performance and posture.
- Ensure SOC operations adhere to the full NIST Cybersecurity Framework: Identify, Protect, Detect, Respond and Recover.
- Manage dedicated business-hours coverage commitments for specific customer offices, including staggered shift scheduling.
- Serve as or direct, the Incident Commander for significant and widespread incidents. Responsibilities include:
- leading incident calls.
- coordinating response across all teams and task orders.
- managing government notifications and stakeholder communications.
- tracking after-action items through remediation.
- Direct the task order incident coordinators within each sub-task area. Ensure playbook adherence and full incident lifecycle documentation in the ticketing system.
- Oversee required reporting to federal oversight bodies, the Inspector General and law enforcement. Oversee reporting of classified spills onto unclassified systems.
- Coordinate with interagency and intelligence community partners such as CISA, the FBI and DHS.
- Execute the operational side of SOC consolidation:
- onboarding new customer organizations’ log sources and alerting.
- standardizing detection logic, escalation protocols and playbooks.
- transitioning onboarded organizations into steady-state operations and maintenance.
- Develop and maintain SOPs, incident response playbooks, an alert severity and triage framework and standardized reporting templates.
- Own SOC performance metrics: mean time to detect, mean time to respond, alert volumes, false positive rates, ticket closure rates and SLA compliance. Explain any deviations and propose corrective actions.
- Build a centralized incident knowledge base and lessons-learned repository that is shared across customer organizations.
- Lead adoption of AI-enabled analytics and next-generation security automation.
- Train SOC staff on operating procedures and ensure analysts maintain tool proficiency.
What you need to know:
- Strong background in cybersecurity incident response across large, complex enterprise environments.
- Proven ability to align SOC functions with the NIST Cybersecurity Framework.
- Experience coordinating subordinate managers and technical leads to deliver cohesive operations.
- Skilled at influencing executive leadership and driving organizational adoption of SOC best practices
- Hands-on SOC leadership experience with Splunk/Splunk ES and EDR platforms such as Trellix/FireEye HX and Microsoft Defender.
- Experience with ServiceNow-based incident management, network intrusion detection (Snort/Zeek), threat intelligence platforms (MISP, STIX/TAXII) and vulnerability tools (Tenable, Qualys).
- Experience managing 24x7 shift-based workforces, including scheduling, coverage, retention and escalation structures.
- Familiarity with federal incident reporting requirements and OMB M-21-31 event logging maturity.
Must have’s:
- Bachelor’s degree or 3+ additional years of relevant experience in lieu of degree.
- 10+ years managing SOC operations and incident response for enterprise environments (50,000+ endpoints), including 5+ years leading hybrid on-premises/cloud SOCs with full NIST Cybersecurity Framework coverage.
- Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking.
- Applicants must hold and maintain an active Secret clearance.
Beneficial to have the following:
- Hold one or more of the following active certifications: Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Manager (GSOM) or Certified Information Security Manager (CISM).
- Experience integrating multiple organizations into a consolidated SOC.
Where it’s done:
