Incident DetectionResponse Manager SOC Manager

Everforth ECS is seeking an Incident Detection/Response Manager (SOC Manager) who lives in close proximity to the National Capital Region (NCR) to join a premier, enterprise-scale cybersecurity program supporting a major federal civilian agency.

Please Note: This position is contingent upon contract award.

Salary Range: $140,000 - $160,000

This flagship initiative unifies 24x7x365 Security Operations (SOC), proactive threat hunting, and advanced Security Engineering and Architecture into a cohesive defensive mission. As a key leader on this program, you will drive the protection of highly sensitive, national-level financial, and personally identifiable information (PII). You will be at the forefront of modernizing the agency's cyber posture, implementing advanced automation, and ensuring continuous operational resilience across a massive, highly complex federal IT enterprise.

As the Incident Detection/Response Manager, you will serve as the operational commander of a high-performing, around-the-clock Security Operations Center supporting a major federal civilian agency. You will direct Tier I, II, and III incident response operations, ensuring rapid detection, containment, and recovery across a large-scale federal IT enterprise. Working closely with threat hunting teams, security engineers, agency stakeholders, and external service providers, you will lead the SOC's day-to-day operations while driving continuous improvement in detection capabilities, response procedures, and overall security posture. When incidents occur, you become the incident commander, orchestrating response from the moment a threat is detected through containment, eradication, and recovery.

Position Responsibilities:

• Manage SOC daily activities, including building and maintaining shift schedules and ensuring all documentation, including SOPs, Playbooks, and CONOPS, are current.
• Manage Tier I, II, and III incident response operations across the federal enterprise, ensuring consistent, high-quality response at every level.
• Coordinate containment, eradication, and recovery activities during active security incidents, serving as the primary incident commander and coordinating between the SOC team, IT operations, and relevant stakeholders.
• Lead post-incident reviews and root cause analysis to identify lessons learned and drive continuous improvement in SOC processes and detection capabilities.
• Ensure compliance with NIST SP 800-61 and federal incident response standard operating procedures across all SOC operations.
• Manage SIEM event "notables" dashboards, ensuring timely triage, escalation, and resolution of security alerts.
• Maintain the SOC coverage schedule per shift to ensure 24x7x365 operational readiness.
• Maintain the call tree, including current contact information for all partner organizations and Cloud Service Providers (CSPs).
• Apply MITRE ATT&CK framework to map attacker tactics, techniques, and procedures (TTPs) during investigations and incident response activities.
• Encourage team collaboration by fostering a positive team culture, managing workloads effectively, and supporting professional development.
• Collaborate with threat hunting, CTI, engineering, and architecture teams to ensure SOC operations are informed by the latest threat intelligence and detection capabilities.
• Present incident findings, risk recommendations, and SOC performance metrics to both technical teams and senior government officials in a clear, actionable format.

Support the development and continuous improvement of a comprehensive enterprise information security program grounded in the latest laws, regulations, and industry best practices.

• U.S. Citizenship required.

• 8+ years of IT experience, with 4+ years of dedicated incident response and SOC operations experience.

• Remote but within close proximity to the NCR.

• Active Public Trust 6c clearance, or the ability to obtain and maintain one.

• At least one of the following certifications: GCIH, GCFA, GREM, or equivalent.

• Hands-on experience with SIEM, SOAR, EDR, CDM, and malware analysis tools and platforms.

• Strong experience with operating systems and networking fundamentals, including log analysis, traffic analysis, and endpoint forensics.

• Experience with AWS native services and tools in a federal or enterprise cloud environment.

• Demonstrated experience managing a SOC overseeing complex, large-scale federal or enterprise IT systems.

• Strong command of incident response frameworks including NIST SP 800-61, SANS PICERL, and MITRE ATT&CK.

• Practical malware analysis fundamentals, including static analysis, sandboxing, and Indicator of Compromise (IoC) extraction.

• Experience with SOAR platforms to automate repetitive elements of incident response and improve analyst efficiency.

• Proven ability to translate complex technical findings into clear, actionable language for both technical and executive audiences.

• Strong written and verbal communication skills, with a track record of producing high-quality federal security documentation.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field or equivalent professional experience.

• At least one of the following certifications:

• Certified Information Systems Security Professional (CISSP)

• GIAC Certified Intrusion Analyst (GCIA)

• GIAC Security Expert (GSE)

• Certified Information Security Manager (CISM)

• AWS Cloud Practitioner or higher, with AWS GovCloud experience desired

• Familiarity with federal cybersecurity frameworks including NIST SP 800-53, NIST RMF, IRS Publication 1075, FedRAMP, and OMB compliance requirements.

• Experience supporting continuous monitoring programs and coordinating with stakeholders on POA&M remediation tracking.

• Prior experience working on large-scale federal civilian agency programs with complex, multi-stakeholder environments.

• Experience with cloud-native security operations in AWS GovCloud or Azure Government environments.

• Familiarity with scripting languages such as Python or PowerShell for log parsing and investigation acceleration.

• Experience integrating CDM program data into SOC workflows and using CDM dashboards to inform incident response priorities.

• Ability to provide strategic guidance that enhances and optimizes the agency's overall SOC and incident response posture.

• Knowledge of DevSecOps pipelines and experience supporting security operations within CI/CD environments.

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We value:

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven

Meet the challenge. Make a difference with Everforth ECS!