Technical Manager - SOC

Role summary

Security engineering and operations

• Lead security platform deployment and improvement across EDR, SIEM, IDS/IPS, MDM, and Microsoft 365 Security.
• Architect controls for endpoint, network, cloud, identity, and business-critical infrastructure; manage security platform integrations.
• Develop detection use cases, tune alerts, build correlation logic and response automation, and oversee endpoint security controls.
• Collaborate across SOC, Infrastructure, IAM, Cloud, and application teams; troubleshoot security events, platform issues, and control gaps.
• Maintain SIEM use cases, rules, dashboards, reports, and metrics; conduct vulnerability assessments and track remediation.
• Support security-impact reviews in change management and build automation using scripting and SOAR workflows.
• Maintain security baselines, hardening standards, playbooks, guides, and technical documentation; use threat intelligence to adapt controls.
• Provide technical leadership, coaching, and mentorship to junior engineers, SOC analysts, and cross-functional teams.

Technical platform duties

• Engineer and administer EDR platforms such as CrowdStrike and Microsoft Defender for Endpoint, including policy tuning, detection, response, and control validation.
• Implement SIEM platforms such as CrowdStrike NG SIEM or Splunk, including log onboarding, parsing, normalization, dashboards, and correlation logic.
• Design and support IDS/IPS and network security monitoring solutions.
• Administer Microsoft 365 Security, including Defender Suite, Entra ID, Conditional Access, Secure Score, and identity protection controls.
• Manage MDM platforms such as Microsoft Intune or equivalent for compliance, device posture, policy enforcement, and access control.
• Implement MFA, Conditional Access, privileged access controls, least privilege, and Zero Trust principles.
• Build SOAR workflows for triage, evidence collection, containment, enrichment, notification, and reporting; integrate threat intelligence feeds.
• Integrate logs from servers, endpoints, networks, cloud platforms, firewalls, identity systems, and business-critical applications.
• Support HIPAA, NIST, ISO 27001, and CIS-aligned evidence gathering, configuration review, reporting, and control validation.

Required experience and qualifications

• Strong hands-on experience in security engineering, control implementation, and enterprise security tool deployment.
• Expertise in incident detection and response, alert tuning, threat hunting, and SOC enablement; experience with firewalls, endpoint, cloud, identity, and Microsoft security.
• Working knowledge of PowerShell, Python, or similar scripting languages and ability to troubleshoot complex security issues across technical environments.
• Understanding of modern attack techniques, adversary behaviors, MITRE ATT&CK, and detection engineering; experience in SOC or enterprise security operations.
• Strong documentation, stakeholder communication, technical leadership, prioritization, and project execution skills.
• Bachelor’s or Master’s degree in IT, Computer Science, Cybersecurity, or a related field; 10+ years in IT Security, including 5+ years in security engineering, implementation, or platform administration.
• Hands-on experience with EDR, SIEM, IDS/IPS, MDM, Microsoft 365 Security, IAM/PAM, vulnerability management, and cloud security controls.
• Understanding of NIST, ISO 27001, CIS Controls, and CIS Benchmarks.