Security Operations Center Manager (CBP)

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. Every system that keeps that mission running, biometric checks against watchlists, apprehension processing, surveillance feeds, is also a target. You run the security operations center that watches for that. You own its people, process, and performance: how alerts get triaged, how work gets prioritized when everything looks urgent at once, and how the center performs as a whole rather than as a collection of individual analysts. You will work closely with the leads who run insider threat monitoring, threat hunting, incident response, digital forensics, and vulnerability assessment, and you are accountable for how well those functions work together. Managing up and out is as much a part of this role as managing the floor.

Responsibilities

Own SOC people, process, and performance; Oversee alert triage and prioritization; Work closely with leads running insider threat monitoring, threat hunting, incident response, digital forensics, and vulnerability assessment; Ensure specialist functions work as one operation; Give leadership an accurate picture of SOC performance and program exposure; Build SOC continuous improvement through lessons learned, analyst development, and standards/playbooks

Requirements

Active Top Secret with SCI Eligibility; ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD; U.S. Citizenship required; CISSP; one of GCFA, GREM, GCIH, OSCP, GPEN, GFCE or equivalent preferred; minimum of five (5) years of direct operational and program management experience in delivery of Cybersecurity program or related projects; minimum of seven (7) years of professional experience with a solid understanding of incident response, insider threat investigations, digital forensics, and cyber threats; minimum of five (5) years of cybersecurity experience with at least 5 years in a SOC leadership capacity; in-depth technical expertise in SIEM, EDR, and incident response methodologies; thorough understanding of network architectures and security controls; ability to create insider threat focused dashboards, reports and workflow diagrams; experience collecting data, chain of custody and reporting results; handling and escalating security issues or emergency situations appropriately; providing incident response capabilities to isolate and mitigate threats; experience with mentoring junior members in an open collaborative environment; Bachelor’s degree in computer science, engineering, STEM or cybersecurity

Nice to have

Active CBP BI strongly preferred; Experience running a security operations center or equivalent detection and response function; Managed a team through a real incident; Reported security posture and incidents to non-technical leadership; Worked inside a federal or highly regulated security program; Comfortable across insider threat, threat hunting, incident response, forensics, and vulnerability assessment; Certifications such as CISSP, GCIH, or CISM

Benefits

$10,000 signing bonus for candidates with active CBP BI, payable after 90 days; Health Insurance; Life Insurance; Paid Time Off; Holiday Pay; short-term and long-term Disability; Retirement; Learning and Development opportunities; optional benefit elections