Senior Cyber Security Manager – CSIRT, SOC

OnTrac

. Lead daily SOC/ARC monitoring, alert triage, investigations, and incident response .

Posted 11/5/2026full-timeRemote • United StatesSenior💰 $156,000 - $195,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in leading Security Operations and Incident Response teams, with a strong focus on developing and maturing SOC capabilities, incident response procedures, and cybersecurity operational metrics. Proficient in managing complex investigations, coordinating high-severity incident responses, and optimizing security tools and processes.

Highest-signal resume keywords

Cybersecurity LeadershipIncident Response ManagementSIEM ImplementationDetection EngineeringCybersecurity Metrics Development

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

CybersecurityIncident ResponseSOC ManagementDetection EngineeringOperational Metrics DevelopmentThreat HuntingSecurity Tool OptimizationAI/ML ImplementationPost-Incident ReviewRegulatory Compliance

Soft Skills

Team LeadershipPersuasionJudgmentCommunicationCoaching

Tools & Technologies

SIEMEDRSOARMSSPCybersecurity DashboardsIncident Response PlaybooksCloud Security ToolsThreat Intelligence PlatformsSecurity Operations Center ToolsAutomated Response Capabilities

Certifications & Qualifications

CISSPCISMGIAC GCIHGIAC GCIAGMONAzure Security EngineerMicrosoft Cybersecurity Architect Expert

Industry Keywords

Cyber DefenseIncident Management24x7 Staffing ModelsPerformance DashboardsRegulatory RequirementsExecutive ReportingCybersecurity ProjectsOperational ObjectivesVendor ManagementSecurity Guidelines

Tech Stack

Tools & technologies

AzureCloudCyber Security

About the role

Key responsibilities & impact

Lead daily SOC/ARC monitoring, alert triage, investigations, and incident response
Manage analysts, shift leads, and incident handlers across all tiers
Define Tier 1/2/3 responsibilities and escalation criteria
Establish sustainable 24x7 coverage using follow-the-sun, dedicated shifts, or hybrid on-call rotations
Ensure qualified staffing and service coverage while developing workforce plans
Build and mature incident response procedures, runbooks, and playbooks
Lead cyber incident response end-to-end and coordinate countermeasures and mitigating controls
Serve as the primary escalation point for complex investigations and significant incidents
Coordinate high-severity incident response across IT, Legal, Communications/PR, and executive leadership
Conduct post-incident reviews, tabletop exercises, cyber simulations, and readiness drills
Track corrective, preventive, and remediation actions to closure
Develop detection engineering and proactive threat-hunting programs
Tune SIEM, EDR, and other security technologies to improve efficacy and reduce false positives
Align detection use cases with MITRE ATT&CK, threat intelligence, emerging threats, and organizational risks
Establish and report MTTD, MTTR, MTTC, detection coverage, alert fidelity, incident volume, severity trends, and analyst productivity
Create SOC/ARC KPIs and KRIs and develop executive dashboards
Optimize security tools, processes, and SIEM/SOAR platforms
Implement AI/ML-supported triage, correlation, and investigation capabilities
Define the division between automated action and human judgment
Align security operations with applicable regulatory requirements and frameworks
Support audits, assessments, and evidence-collection activities
Manage the SOC operating budget across tools, staffing, and managed services
Oversee MSSPs, MDR providers, incident response retainers, and security technology partners
Define and enforce vendor and contract SLAs
Recruit, coach, mentor, and develop security operations personnel
Establish career paths, training programs, skills assessments, and succession plans
Lead the strategy and execution of major cybersecurity projects
Set operational objectives, policies, procedures, and work plans
Delegate responsibilities effectively across the team
Engage with frontline and senior management across multiple functions, departments, and customers
Navigate sensitive, complex situations using persuasion and sound judgment

Requirements

What you’ll need

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field; Master’s degree preferred
10 years of progressive, direct hands-on cybersecurity experience
5 years of leadership experience managing Security Operations, Incident Response, Cyber Defense, and SOC teams
Demonstrated experience building and maturing SOC capabilities, incident response programs, and detection engineering functions
Experience developing cybersecurity operational metrics, executive reporting, and performance dashboards, including MTTD, MTTR, KPIs, and KRIs
Proven success implementing SIEM, EDR, SOAR, and automated or AI-assisted response capabilities
Experience managing 24x7 staffing models, budgets, and third-party security vendors or MSSP’s
Preferred certifications include CISSP, CISM, GIAC GCIH, GIAC GCIA, and GMON
Cloud security certifications such as Azure Security Engineer, Associate or Microsoft Cybersecurity Architect Expert preferred
Responsibility to understand and adhere to OnTrac’s Acceptable Use policy and security guidelines

Benefits

Comp & perks

Medical, dental, and vision insurance
Life and short- and long-term disability coverage
401(k) retirement savings plan with company match
Flex vacation in states other than CA, CO, IL, MA, MT, and NE, with accruals up to 96 hours for first year of employment with tenure-based increases up to 160 hours
Two (2) floating holidays per year
Paid sick leave
Six (6) paid company holidays
Two (2) weeks paid pregnancy disability leave
Four (4) weeks paid parental bonding leave
Additional wellness and employee assistance programs
Up to a 20% Bonus Target