Security Operations Manager

Job Family:
Cyber Consulting Travel Required:
Up to 10% Clearance Required:
Active Secret
Seeking highly skilled and versatile SOC Manager, to assist in providing comprehensive cybersecurity support services to protect critical consular systems and data for a large Federal Agency. The SOC Manager serves as the primary technical lead for all security operations and monitoring activities under this call order. Oversees 24/7 operational coverage. Coordinates directly with the ISSOs to ensure technical security evidence, remediation actions, and operational data are delivered in support of RMF and A&A activities. Ensures all security operations activities align with ISSO-approved security baselines and Department policies.
What You Will Do:

Implement and operate Security Information and Event Management (SIEM) processes for covered Oracle systems:

- Configure SIEM to collect security events from Oracle systems

- Develop correlation rules for Oracle-specific security events - Monitor SIEM alerts and investigate security anomalies

- Provide SIEM data and alerts to ISSO(s) for incident response coordination

- Conduct Open-Source Intelligence Threat (OSINT) monitoring for Oracle-specific threats:

- Monitor Oracle security advisories and vulnerability disclosures

- Track threat intelligence related to Oracle database attacks

- Provide threat intelligence summaries to ISSOs weekly

- Perform digital forensics and log analysis for covered systems:

- Analyze Oracle audit logs, AVDF reports, and PUM access logs

- Investigate security anomalies and suspicious activities

- Provide forensic findings to ISSO and incident response teams

- Support ISSO-led incident response activities:

- Execute technical incident response actions as directed by ISSO

- Provide system logs, forensic data, and technical analysis –

- Implement incident containment and remediation measures per ISSO direction

- Document incident response actions and provide to ISSO for incident reports

- Perform operational security posture assessments:

- Conduct technical security reviews of Oracle system configurations

- Identify security weaknesses and configuration vulnerabilities

- Provide assessment findings to ISSO for POA&M development

- Implement ISSO-directed security improvements

- Maintain long-term storage of security logs and audit data:

- Retain Oracle audit logs, AVDF data, and PUM access logs per DOS retention requirements

- Ensure log data availability for ISSO-led compliance audits and assessments

- Provide historical log data to ISSO upon request for correlation and analysis

What You Will Need:

- Minimum of SEVEN (7)+ years of overall work experience.

- Bachelors degree from an accredited university.

- Must have active CISSP, GCIA or equivalent certification

- Must be able to OBTAIN and MAINTAIN a Federal or DoD "SECRET" security clearance; candidates must obtain approved adjudication of clearance prior to onboarding with Guidehouse . Candidates with an ACTIVE "SECRET" or higher-level clearance are preferred.

- US Citizenship is contractually required.

- Strong familiarity with SIEM platforms, endpoint detection and response (EDR) tools, and SOAR workflow automation.

- Demonstrated ability to develop and maintain detection use cases, playbooks, and investigative procedures.

- Experience defining and reporting SOC metrics and KPIs to measure effectiveness and drive operational improvements.

- Excellent written and verbal communication skills with the ability to communicate technical details to non-technical stakeholders and executive leadership.

- Proven leadership skills: coaching, performance management, scheduling for 24/7 operations, and handling escalations under pressure.

What Would Be Nice To Have:

- Master’s in computer science, IT, cybersecurity or related field

- Experience working with the Department of State preferred

The annual salary range for this position is $149,000.00-$248,000.00. Compensation decisions d