SOC Manager

Our bench is in the back of a strip-mall storefront, where we image laptops and swap failed drives. Every tech does a bit of everything, from printer jams to firewall rules. We started in 2023 and have grown to about 43 people.

Job summary

This role opened up after a team member moved internally. The operations team runs a 24/7 SOC. We need someone who can work through an alert queue and tell which ones matter. Our headquarters is in Mount Vernon, and about a third of the team works remotely from other countries. Contract role, full-time hours, paid in USD at the end of each month. Expect to work a schedule that overlaps with US Eastern business hours until about noon ET. Most communication happens in Slack, with short video calls when needed.

Responsibilities

• Investigate endpoint alerts in CrowdStrike Falcon, SentinelOne or Defender for Endpoint
• Document incidents with timeline, impact and root cause
• Check threat intelligence feeds and IOCs against our environment
• Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM
• Escalate confirmed incidents and follow the incident response plan
• Help with user access reviews and offboarding audits
• Tune noisy detection rules with the security engineering team
• Review firewall, proxy, VPN and authentication logs for suspicious activity

What we're looking for

• 8-10 years in an SOC, security analyst or IT security role
• Working knowledge of SIEM and EDR tools
• CompTIA Security+ or equivalent (or ability to obtain within six months)
• Clear written communication for incident tickets and reports
• Understanding of TCP/IP, DNS, HTTP and common ports and protocols
• Familiarity with the MITRE ATT&CK framework

Schedule: Four 10-hour shifts, Sunday to Wednesday, 6:00 AM to 4:30 PM

What we offer

• Paid in USD
• Long-term engagement
• Flexible hours
• Annual rate review

Duration: 12 months. Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at FB Managed Services.