Job description

Position: Manager, Security Operations Center (SOC) Location: Hybrid – College Park, MD (On-site 2–3 days per week) Work Authorization: US Citizenship Required BlueVoyant is seeking a Manager, Security Operations Center (SOC) to lead a growing SOC organization of roughly 60 employees, playing a critical role in protecting client relationships and driving retention. This is a client-facing leadership role responsible for shaping how customers experience the SOC — from escalation handling through the metrics and reporting that inform leadership decisions. The role carries strong potential for growth into a higher-level leadership position as the team and business scale, making it a great fit for an ambitious leader who wants to build and shape a growing organization. What You'll Do: • Lead, develop, and manage a team of Team Leads, Trainers, and Security Analysts, providing strategic direction, coaching, and performance management • Assume full responsibility and accountability for ensuring all SOC customers receive world-class service • Own the management of customer escalations, with the primary goal of client retention, partnering closely with Client Success on remediation plans and client communication • Provide oversight and management of Team Leads and the wider Analyst team, ensuring consistent quality and performance across the SOC • Lead post-incident review meetings to capture lessons learned following the resolution of critical events • Ensure key Security Operations actions incorporate relevant customer impact considerations by engaging key stakeholders and communicating known/suspected implications of technical decisions • Validate that Security Operations activities adequately address customer requirements across all MSS services • Oversee operations in deterring, identifying, monitoring, investigating, and analyzing network intrusions • Supervise complex event investigation and incident declaration, ensuring events are properly identified, analyzed, and escalated to incidents • Ensure the team's incident investigation, handling, response, and documentation meet quality and SLA standards • Assist in the advancement of security policies, procedures, and automation • Develop incident response reporting and policy updates as needed • Partner cross-functionally with Client Success, Content Engineering, Threat Hunt, and Product leadership to drive service improvements and represent the SOC's priorities • Develop and maintain SOC performance metrics, delivering regular reporting on team performance, incident trends, and customer outcomes to leadership • Regularly communicate with customer IT teams to inform them of issues, help them remediate, and ensure continued business as usual • Maintain a strong awareness of the current threat landscape What You'll Bring: • Ability and willingness to commute to the College Park, MD office 2–3 days per week • Experience working within a global organization, partnering with distributed teams across multiple regions and time zones • Prior experience managing managers or team leads, with direct accountability for team performance and development • Ability to handle high-pressure situations in a productive and professional manner • Ability to work directly with customers to understand requirements for and feedback on security services, including managing escalations to protect client relationships • Advanced written and verbal communication skills, with the ability to present complex technical topics in clear and easy-to-understand language • Strong teamwork and interpersonal skills, including the ability to work effectively with a globally distributed team • Able and willing to work in a 24/7/365 environment Technical Expertise: • Knowledge of and experience with the Microsoft Security Stack (Defender, Sentinel etc) • Knowledge of and experience with intrusion detection/prevention systems and SIEM software • Advanced knowledge and understanding of network protocols and devices • Advanced experience with Mac OS, Windows, and Unix systems • Ability to analyze event logs and recognize signs of cyber intrusions/attacks • Strong knowledge of: SIEM, Packet Analysis, SSL Decryption, Malware Detection, HIDS/NIDS, Network Monitoring Tools, Case Management System, Knowledge Base, Web Security Gateway, Email Security, Data Loss Prevention, Anti-Virus, Network Access Control, Encryption, and Vulnerability Identification Nice to Have: • Experience partnering with or managing teams based in the Philippines • Experience in network/host vulnerability analysis, intrusion analysis, digital forensics, penetration testing, or related areas • 8+ years of hands-on SOC/TOC/NOC experience • Certifications such as GCIA, GCIH, GCFA, GCFE, CISSP, Security+, Network+, CEH, RHCA, RHCE, MCSA, MCP, or MCSE • Familiarity with tools such as IDA Pro, PEiD, PEview, Procmon, Snort, Bro, Kali Linux, Metasploit, NMAP, and Nessus • Familiarity with GPO, Landesk, or other IT infrastructure tools • Understanding of and/or experience with one or more programming languages: .NET, PHP, Perl, Python, Java, Ruby, C, C++ Education: Bachelor’s degree in Information Security, Computer Science, or another technology / engineering-related field preferred. Candidates with proven experience in security/network operations will also be considered. Why BlueVoyant? • Work alongside experienced SOC and cybersecurity leaders, including former government cyber professionals and industry veterans • Gain exposure to complex customer environments and a wide range of MSS services across industries • Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise • Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth About BlueVoyant BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization’s network, identities, vendors, and digital footprints as a single attack surface. The company’s award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance. Led by CEO, John Hernandez, BlueVoyant’s highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies. Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.. All employees must be authorized to work in the United States of America. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements, BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities. Disclaimer: Please note that pursuant to contractual requirements and applicable law, for employees to perform work on some of the company’s federal contracts, U.S. citizenship is required. Accordingly, an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status. #LI-Hybrid Important Information for Applicants: BlueVoyant uses AI-assisted tools within our applicant tracking system to help identify candidates whose experience and skills best match the requirements of a role. This technology provides hiring teams with added insights to support fair and efficient hiring decisions. All applications are reviewed by a member of our hiring team, and final hiring decisions are made by humans, not AI. By submitting your application, you acknowledge that AI tools may assist in the evaluation of your resume as part of the recruitment process. Interview Expectations: As part of our interview process, we assess your experience through real-time discussion, so we expect responses to be your own. While we embrace the use of AI within our business and recruitment process, we do not permit its use during interviews. Any suspected use of AI during an interview will be challenged, and this may include the use of detection tools. BlueVoyant Candidate Privacy Notice: To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice

Requirements

Must-haves

Position: Manager, Security Operations Center (SOC)
Location: Hybrid – College Park, MD (On-site 2–3 days per week)
Work Authorization: US Citizenship Required
BlueVoyant is seeking a Manager, Security Operations Center (SOC) to lead a growing SOC organization of roughly 60 employees, playing a critical role in protecting client relationships and driving retention.
Lead, develop, and manage a team of Team Leads, Trainers, and Security Analysts, providing strategic direction, coaching, and performance management
Assume full responsibility and accountability for ensuring all SOC customers receive world-class service
Own the management of customer escalations, with the primary goal of client retention, partnering closely with Client Success on remediation plans and client communication
Provide oversight and management of Team Leads and the wider Analyst team, ensuring consistent quality and performance across the SOC
Lead post-incident review meetings to capture lessons learned following the resolution of critical events
Ensure key Security Operations actions incorporate relevant customer impact considerations by engaging key stakeholders and communicating known/suspected implications of technical decisions
Validate that Security Operations activities adequately address customer requirements across all MSS services
Oversee operations in deterring, identifying, monitoring, investigating, and analyzing network intrusions
Supervise complex event investigation and incident declaration, ensuring events are properly identified, analyzed, and escalated to incidents
Ensure the team's incident investigation, handling, response, and documentation meet quality and SLA standards
Assist in the advancement of security policies, procedures, and automation
Develop incident response reporting and policy updates as needed
Partner cross-functionally with Client Success, Content Engineering, Threat Hunt, and Product leadership to drive service improvements and represent the SOC's priorities

Nice-to-haves

Experience partnering with or managing teams based in the Philippines
Experience in network/host vulnerability analysis, intrusion analysis, digital forensics, penetration testing, or related areas
Certifications such as GCIA, GCIH, GCFA, GCFE, CISSP, Security+, Network+, CEH, RHCA, RHCE, MCSA, MCP, or MCSE
Familiarity with tools such as IDA Pro, PEiD, PEview, Procmon, Snort, Bro, Kali Linux, Metasploit, NMAP, and Nessus
Familiarity with GPO, Landesk, or other IT infrastructure tools
Understanding of and/or experience with one or more programming languages: .NET, PHP, Perl, Python, Java, Ruby, C, C++
Bachelor’s degree in Information Security, Computer Science, or another technology / engineering-related field preferred. Candidates with proven experience in security/network operations will also be considered.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

pythonjavaai

Platform: jazzhr
Effort: medium