Security Operations Center Manager

Nelnet

. Lead and develop the SOC team, including security analysts, incident responders, and threat intelligence specialists .

Posted 11/4/2026full-timeUnited StatesMid-LevelSenior💰 $105,000 - $140,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading Security Operations Center (SOC) teams, managing incident response processes, and developing threat intelligence capabilities. Proficient in utilizing SIEM, SOAR, and EDR tools to enhance security monitoring and incident management.

Highest-signal resume keywords

SOC Team LeadershipIncident Response ManagementSIEM Platform ExpertiseThreat Intelligence DevelopmentCybersecurity Metrics Tracking

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SIEM PlatformsSOAREDRIncident ResponseThreat IntelligencePython ScriptingPowerShell ScriptingDetection EngineeringAlert TuningCloud Security Monitoring

Soft Skills

Analytical SkillsProblem-SolvingDecision-MakingCommunication SkillsTeam Collaboration

Tools & Technologies

SplunkGoogle SecOpsLogRhythmCrowdStrikeSentinelOneMicrosoft DefenderCodexClaudeGeminiMITRE ATT&CK

Certifications & Qualifications

CCSPCISMBTL1BTL2CompTIA Security+CySA+GIAC

Industry Keywords

NIST CSFNIST 800-53ISO 27001PCI DSSFinancial ServicesRegulated IndustryDigital ForensicsThreat HuntingPurple Team Exercises

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityFirewallsPythonSplunk

About the role

Key responsibilities & impact

Lead and develop the SOC team, including security analysts, incident responders, and threat intelligence specialists
Build a collaborative, high-performance, and positive team culture
Set goals, conduct performance reviews, and identify training and certification needs
Manage staffing, shift coverage, and on-call schedules
Oversee daily security monitoring, alert triage, detection, and analysis of security events
Develop and maintain SOC policies, procedures, playbooks, and workflows
Manage and optimize SIEM, SOAR, EDR, and threat intelligence platforms
Drive detection engineering and alert tuning to reduce false positives and close visibility gaps
Define, track, and report SOC metrics and KPIs including MTTD, MTTR, alert volume, and detection coverage
Ensure timely and accurate incident escalation
Lead incident response through containment, eradication, and recovery
Maintain the incident response plan and run testing and tabletop exercises
Conduct post-incident reviews and implement lessons learned
Lead the cyber threat intelligence function and set intelligence requirements
Produce actionable threat intelligence, including threat actor tracking, IOCs, and TTPs
Turn intelligence into detections, hunts, and response playbooks
Brief security leadership on emerging threats
Participate in industry intelligence-sharing communities
Automate repetitive SOC tasks through SOAR playbooks and scripting
Apply Codex, Claude, and Gemini to improve SOC processes, alert triage, and investigations with human review and data-handling controls
Align detections to MITRE ATT&CK
Collaborate with Vulnerability Management, Security Engineering, Detection Engineering, Risk Management, IT, Compliance, business units, law enforcement, industry peers, and managed security vendors
Lead and collaborate on Purple Teaming exercises

Requirements

What you’ll need

Bachelor’s degree in computer science, Information Security, or a related field, or equivalent practical experience
3+ years of cybersecurity experience, including 2+ years working in a Security Operations Center (SOC)
1+ years of experience leading or managing a team, including team lead or supervisor roles
Hands-on expertise with SIEM platforms such as Splunk, Google SecOps, or LogRhythm, including investigation, correlation rules, detection engineering, and alert tuning
Working knowledge of SOAR, firewalls, and EDR platforms such as CrowdStrike, SentinelOne, or Microsoft Defender
Proven experience leading incident response from detection through containment, eradication, recovery, and post-incident review
Understanding of threat intelligence principles and frameworks, including MITRE ATT&CK
Strong analytical, problem-solving, and decision-making skills
Excellent written and verbal communication skills
Professional certifications such as CCSP, CISM, BTL1, BTL2, CompTIA Security+/CySA+, or GIAC certifications preferred
Experience with cloud security monitoring in AWS, Azure, or Google Cloud preferred
Knowledge of NIST CSF, NIST 800-53, ISO 27001, and PCI DSS preferred
Experience with Python or PowerShell scripting or automation preferred
Background in financial services or another regulated industry preferred
Experience with digital forensics, threat hunting, or purple team exercises preferred
Familiarity with Codex, Claude, and Gemini and their responsible use in SOC processes preferred
Must already be authorized to work in the United States without current or future sponsorship

Benefits

Comp & perks

Medical, dental, and vision insurance
HSA and FSA
Generous earned time off
401K/student loan repayment
Life insurance and AD&D insurance
Employee assistance program
Employee stock purchase program
Tuition reimbursement
Performance-based incentive pay
Short- and long-term disability
Robust wellness program
Hybrid work option with remote work part of the week for associates living within 30 miles of an office