Security Operations Center; SOC Manager

POSITION SUMMARY :

The Security Operations Center (SOC) Manager is responsible for all internal security operations tasks and management of the Security Operations Center.

Provides leadership and tactical direction for Security Operations Center (SOC) functions. The SOC Manager will be expected to work alongside the team to detect and respond to information security incidents, develop, maintain, and follow procedures for security event alerting, and participate in security investigations.

The SOC Manager should have familiarity with the principles of network and endpoint security, current threat and attack trends, a basic understanding of the OSI model, and have a working knowledge of defense in depth strategies.

• Serves as technical expert on SOC matters including items related to monitoring and response of partner and client operations and provides input to Executive Management on the overall strategic direction.
• Ensures staff compliance with all applicable laws, regulations, industry standards, corporate policies, guidelines and procedures, including but not limited to, NIST, ISO, PCI, HIPAA and SOC requirements.
• Promotes an environment of compliance and continuous improvement to meet the Corporation's goals and objectives.
• Develops and maintains a highly qualified and motivated workforce that supports the corporate mission, goals, and objectives.
• Additional responsibilities include creating processes, assessing incident reports, and developing and implementing crisis communication plans.
• To create compliance reports, support the audit process, measure SOC performance metrics, and report on security operations to business leader's quarterly business reviews and on demand for clients as required.

• Supervise and monitor the quality of services provided
• Recruit, select, train, assign, schedule, coach, counsel staff
• Provide exceptional tier - operational management, analysis, and investigation of security incidents
• Communicate job expectations; planning, monitoring, appraising, and reviewing job contributions
• Contribute security information and recommendations to strategic plans and reviews
• Prepare and complete security action plans; implement production, productivity, quality, and customer-service standards; resolve problems; complete audits; identify trends
• Act as liaison between the Security Operations team and the customer's technical management staff
• Work independently and / or collaboratively with management team to set and / or implement policies, procedures and systems and to follow through with implementation
  • Communicate all operating policies and / or issues at department meetings
• Plans, schedules, and reviews workload and Client to make sure metrics are being met most efficiently
• Inform senior management about performance and issues, including escalations
• Monitor and manage customer SLA compliance for SOC
• Extensive experience working with SIEM, Log Aggregators, Incident Response Management solutions
• Strong technical knowledge of Networking, Operating Systems and enterprise integrations
  • Experience managing standards, developing Security Operations Process
• Proven experience with multiple security event detection platforms
• Thorough understanding of TCP / IP
• Understand IDS / IPS rules to identify and / or prevent malicious activity
• Thorough understanding of application protocols
• Provide exceptional tier - operational management, analysis, and investigation of security incidents Incident Response
• Respond to network-based attacks
• Network infrastructure attacks
• Perform incident detection
• Network incidents
• Member of a CSIRT (Computer Security Incident Response Team)
• Monitor and analyze resources such as Stellar Starlight, QRadar, Alien Vault and others; data feeds of alerts and logs from firewalls, routers, and other network devices or hosts; and data feeds and / or alerts from network-based IDS / IPS to watch for security violations and determine vulnerabilities.
• Conducts initial triage of security events and incidents. Facilitates communication within the SOC and documents progress throughout the Incident Response Lifecycle.
• Recognizes potential, successful, and unsuccessful intrusion…