Security Operations Center Lead

- Oversee and manage all Tier 1, Tier 2, and Tier 3 security operations, including monitoring, detection, investigation, response, and resolution of security incidents. - Ensure continuous 24/7 SOC operations for monitoring, detection, investigation, response, and remediation of security issues; create and manage comprehensive analyst schedules and coverage for absences. - Administer day-to-day SIEM operations, including managing data ingestion, health checks, performance optimization, and cost management; lead efforts in detection engineering to develop and implement custom analytics rules, hunting queries, and EDR detection policies. - Direct the integration of DoD, DISA, and CISA threat intelligence and supervise the creation and deployment of custom Microsoft Sentinel analytics rules, hunting queries (KQL), and EDR detection policies. - Manage vulnerability management processes using Tenable, integrating threat intelligence feeds when necessary, and coordinating the remediation of vulnerabilities. - Ensure compliance with DoD evidence handling standards for forensic data collection and adherence to frameworks like NIST 800-53, DoD STIGs, and MITRE Telecommunications. - Lead purple team and tabletop exercises across various IT teams within the organization. - Develop, track, and report on critical KPIs and SOC metrics (such as MTTR, false positive rate, and closure rate).