Job description

Job Title SOC & Incident Response Lead Client Company/Dept. Name Western Wyoming Community College Address 2500 College Drive, E-460 City Name Rock Springs State Name WY-Wyoming Zip Code 82901 If others (Address) Duration of the project Project Start Date Nov. 13, 2026 Project End Date 3-year initial term, with renewal options Due date for Resume submission 10/15/2026 No. of Openings 1 No. of Maximum Submissions 1 Job Description Role summary: Runs the security monitoring service WWC asked for in Addendum 3, Q14: continuous threat monitoring, detection, alerting, escalation and incident support. Owns how alerts are triaged and escalated to WWC staff, and leads technical incident response. Reports to: vCISO Works with: WWC information security analyst and systems/network administrators; Service Desk Manager for user-reported incidents Location: US-based; remote, with onsite incident response available Allocation: 0.5 FTE leadership of a 24/7/365 monitoring operation; on-call escalation point Key responsibilities: • Design and run 24/7/365 security monitoring and threat detection for WWC: hours of active monitoring, technology, alert triage and escalation, and the response actions WWC pre-approves. • Onboard WWC log sources into SIEM/XDR, preferably Microsoft Sentinel and Defender XDR under M365 A5: Entra ID, Exchange Online, endpoints (Intune and Jamf managed), firewalls, servers and the Colleague SQL environment. • Build and tune detection use cases for higher-ed threats: credential stuffing on student accounts, business email compromise, financial aid fraud, ransomware and MFA fatigue. • Author and maintain the incident response plan, playbooks and escalation matrix aligned with NIST SP 800-61. • Lead technical incident response: containment, eradication, recovery, evidence handling and coordination with forensics or IR retainer partners. • Run annual incident response tabletop exercises with WWC leadership and IT. • Run threat hunting and threat intelligence (including REN-ISAC and CISA advisories). • Produce monthly SOC metrics: alert volumes, mean time to detect, mean time to respond, incidents and trends. Deliverables owned: the SOC service model and runbook, incident response plan and playbooks, tabletop exercise reports, monthly SOC/MDR reports, and post-incident reports. Skill set info Experience: 12+ years in security operations, including 6+ years leading a SOC, MDR or incident response team Required qualifications: • 12+ years in cybersecurity operations, with 6+ years leading SOC, MDR or DFIR teams. • Hands-on expertise with Microsoft Sentinel (KQL), Defender XDR and Entra ID; experience with another SIEM such as Splunk or QRadar is a plus. • Led response to ransomware, business email compromise and data exposure incidents, including regulatory notification support (FERPA, GLBA, state breach laws). • Knowledge of the MITRE Telecommunication&CK framework, NIST SP 800-61 and evidence chain of custody. • Bachelor's degree in Cybersecurity or Computer Science, or equivalent experience. Preferred: SOC experience for colleges, universities or K-12 / public sector; experience running a cyber insurance-aligned IR retainer. Education Bachelor's degree in Cybersecurity or Computer Science, or equivalent experience. Certifications (if required) Certifications (required: at least one of): GIAC GCIH, GCIA or GCFA; CISSP. Preferred: Microsoft SC-200, GIAC GNFA, EC-Council ECIH. Documentation Required for submission Updated Resume Work Hours 0.5 FTE leadership of a 24/7/365 monitoring operation; on-call escalation point Account Manager Name (Proposal Team) Work authorization required USC/GC/EAD/H1 also Relocation is accepted No Remote work Yes, remote is fine. Onsite incident response available as needed Additional Notes if any Candidate can be based anywhere in the US. Being located in or near Rock Springs, Wyoming is a preference only, not a requirement. Must be available for onsite incident response if needed. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Privacy Policy - Abacus .

Requirements

Must-haves

SOC & Incident Response Lead
Client Company/Dept. Name
Western Wyoming Community College
2500 College Drive, E-460
Rock Springs
If others (Address)
Duration of the project
Project Start Date
Nov. 13, 2026
Project End Date
3-year initial term, with renewal options
Due date for Resume submission
No. of Openings
No. of Maximum Submissions
Reports to: vCISO
Works with: WWC information security analyst and systems/network administrators; Service Desk Manager for user-reported incidents
Location: US-based; remote, with onsite incident response available
Allocation: 0.5 FTE leadership of a 24/7/365 monitoring operation; on-call escalation point
• Design and run 24/7/365 security monitoring and threat detection for WWC: hours of active monitoring, technology, alert triage and escalation, and the response actions WWC pre-approves.
• Build and tune detection use cases for higher-ed threats: credential stuffing on student accounts, business email compromise, financial aid fraud, ransomware and MFA fatigue.
• Author and maintain the incident response plan, playbooks and escalation matrix aligned with NIST SP 800-61.

Nice-to-haves

• Hands-on expertise with Microsoft Sentinel (KQL), Defender XDR and Entra ID; experience with another SIEM such as Splunk or QRadar is a plus.
Preferred: SOC experience for colleges, universities or K-12 / public sector; experience running a cyber insurance-aligned IR retainer.
Certifications (required: at least one of): GIAC GCIH, GCIA or GCFA; CISSP. Preferred: Microsoft SC-200, GIAC GNFA, EC-Council ECIH.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

sqlai

Platform: jobdiva
Effort: medium