USAF - SOC Lead
Linthicum Heights, MD
Full Time
USAF - DC3
Experienced
cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.
Qualifications:
Qualifications:
- Active TS/SCI clearance
- B.S. Computer Science, Information Technology, or a related field
- Experience leading SOC personnel or comparable defensive cybersecurity operations.
- Experience directing alert triage, threat hunting, investigations, and incident response.
- Ability to manage operational priorities, analyst development, coverage, and handoffs.
- Knowledge of networks, endpoints, cloud environments, logs, and common cyberattack techniques.
- Experience with security monitoring, endpoint detection, vulnerability tools, and detection tuning.
- Ability to coordinate remediation and response across operations, engineering, and cybersecurity teams.
- Understanding of evidence handling, secure configurations, compliance records, and operational risk.
- Strong judgment and communication skills for timely Government reporting and incident coordination
- Lead SOC analysts and assigned response personnel; prioritize work, coach staff, review investigations, and maintain clear accountability for operational actions.
- Plan assigned staffing, coverage, on-call rotations, and handoffs to support required on-site and global response capabilities.
- Support SOC stand-up planning, tool configuration, sensor integration with command and control (C2) nodes, and enterprise scanning readiness.
- Coordinate centralized defensive operations, including monitoring, penetration testing support, threat hunting, cyber orders and taskers, and incident response.
- Oversee alert triage and analysis of security events and trends; validate findings, assess mission impact, and direct approved mitigation actions.
- Lead data and intelligence-driven threat hunting and anomaly investigations across DC3 information technology (IT) and operational technology (OT) environments.
- Direct incident detection, investigation, escalation, and approved containment, eradication, and recovery; keep Government stakeholders informed under established procedures.
- Review investigation evidence, incident timelines, and reports for accuracy and completeness; ensure response actions and handoffs are documented.
- Coordinate weekly vulnerability assessments with certified specialists; prioritize findings and track remediation with infrastructure, application, and cybersecurity teams.
- Maintain effective C2 coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities.
- Manage assigned cyber orders and taskers, coordinate implementation, and support required compliance documentation and Plans of Action and Milestones (POA&Ms).
- Assess SOC tools, telemetry coverage, and resource needs; recommend procurement and operational improvements through approved Government processes.
- Maintain incident response procedures, escalation guides, and operational documentation; incorporate lessons learned and submit required updates for Government approval.
- Coordinate with ISSOs and the ISSM to provide monitoring evidence and remediation status supporting RMF, authorization, and enterprise risk activities.
- Recommend improvements based on emerging threats, cybersecurity practices, and technologies, including benefits, risks, and implementation approaches.
Apply for this position
Required*