Quick overview
SeniorityMid Senior
Employment typeFull Time
Work modeRemote
LocationWashington DC, United States
AWSComplianceContinuous ImprovementRoot Cause AnalysisSchedulingLinux
Job description
True Zero Technologies, a veteran-owned small business, was founded on the principle that the purposeful enablement of people and technology in an organization directly ties to the quality of its outcomes. True Zero recognizes that those outcomes begin and end with our people, and that is what we have built a community of like-minded, driven, and passionate individuals and innovators who are aligned in a common goal of delivering top-tier services to our customers. Our culture and commitment have been recognized through numerous accolades, including being named one of the Best Places to Work in 2023 in two categories (“Prosperous and Thriving” ($5MM–$50MM in gross revenue) and “Mid-Atlantic Region” (DC, DE, MD, NC, VA, WV)), and again in 2025 as a Best Places to Work honoree. In addition, True Zero earned coveted spots on the Inc. 5000 list of fastest-growing companies in America in 2022, 2023, and 2025, a testament to our sustained growth driven by our people-first approach and unwavering dedication to excellence.
Position Overview
True Zero Technologies is seeking an experienced Security Operations Center (SOC) Manager to oversee daily cybersecurity operations, incident response activities, and security monitoring capabilities within complex federal environments. This leadership position is responsible for managing Tier I, II, and III SOC personnel, ensuring effective security incident detection and response, maintaining operational readiness, and driving continuous improvements in SOC processes, tools, and procedures.
The ideal candidate will possess extensive cybersecurity operations and incident response experience, strong technical leadership capabilities, and expertise in security monitoring technologies, incident management, cloud security, and federal cybersecurity standards.
Job Responsibilities
- SOC Operations & Personnel Management: Direct daily SOC operations, oversee Tier I, II, and III security analysts, manage staffing and shift coverage schedules, and ensure continuous security monitoring, operational readiness, and effective execution of incident response activities across federal enterprise environments.
- Incident Response Leadership & Coordination: Manage the full incident response lifecycle, including detection, analysis, containment, eradication, and recovery. Coordinate response efforts across cybersecurity teams, IT operations, cloud service providers (CSPs), and federal stakeholders to minimize operational disruption and security risk.
- Security Monitoring & SOC Technology Oversight: Oversee the operational effectiveness of Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), and Continuous Diagnostics and Mitigation (CDM) technologies. Manage SIEM event notables, dashboards, and alert prioritization to maintain enterprise security visibility.
- Incident Investigation & Continuous Improvement: Lead post-incident reviews, root cause analysis, and lessons-learned activities to identify security control deficiencies, improve detection capabilities, and implement corrective actions that strengthen the organization's overall cybersecurity posture.
- SOC Documentation & Process Management: Develop, maintain, and continuously improve Standard Operating Procedures (SOPs), incident response playbooks, Concepts of Operations (CONOPS), escalation procedures, and other operational documentation to ensure consistent and efficient SOC execution.
- Federal Compliance & Incident Response Standards: Ensure SOC operations and incident response activities align with NIST SP 800-61, applicable federal cybersecurity requirements, and customer-specific incident response policies, procedures, and reporting obligations.
- Operational Communications & Stakeholder Coordination: Maintain SOC escalation call trees, emergency contact information, and communication protocols for internal teams, partner organizations, and cloud service providers. Lead operational briefings, shift transitions, and incident communications to ensure timely coordination and leadership awareness.
Job Responsibilities
Job Requirements
- Cybersecurity & Incident Response Experience: Minimum of 8 years of progressive IT or cybersecurity experience, including at least 4 years of hands-on incident response experience, with demonstrated responsibility for managing security operations, coordinating incident investigations, and supporting complex enterprise environments.
- Professional Certifications: Must possess at least one of the following certifications: GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Analyst (GCFA), GIAC Reverse Engineering Malware (GREM), or an equivalent industry-recognized cybersecurity certification.
- SOC Leadership & Operational Management: Proven experience managing or leading a Security Operations Center supporting complex enterprise systems, including oversight of Tier I, II, and III personnel, 24/7 operational coverage, incident escalation, shift scheduling, and security operations processes.
- Security Technologies & Incident Analysis: Demonstrated hands-on experience with SIEM, SOAR, EDR, CDM, and malware analysis tools, including security event correlation, threat investigation, incident response automation, and development or management of security monitoring dashboards.
- Operating Systems, Networking & Cloud Security: Strong technical understanding of Windows and Linux operating systems, enterprise networking, security protocols, and AWS-native security services and tools, with the ability to oversee incident detection, investigation, and response across on-premises and cloud environments.
Job Requirements
Haystack's AI agent can fill in and submit this application for you. How AI auto apply works