Security Operations Center (SOC) Manager
Security Operations Center (SOC) Manager
Department: Security Operations
Reports To: Director of Operations
Employment Type: Full-Time, Exempt
Work Location: Onsite, Huntsville, Alabama (MAD Security headquarters and 24/7 SOC). Weekday business hours with availability for escalation outside them. Not remote.
Travel Requirements: Occasional travel for client meetings and industry events
Position Summary
You lead the SOC Desk Manager and the SOC Technical Lead, and through them the entire SOC team. You set direction for the service while your managers run day-to-day operations. You work as part of a multi-function team that includes network and firewall engineers, cyber operations technical leads, and compliance consultants, in a company that is CMMC Level 2 certified and an authorized C3PAO.
Primary Responsibilities
Oversee the 24/7 SOC and own its outcomes for clients, including service performance against client SLAs and KPIs.
Run the SOC service to its published operating standards; staff it, enforce the standards, and improve them where they fall short.
Own the tier definitions and the training and certification standard for the SOC team; enforce them and keep them current.
Own SOC measurables and reporting cadence, and own capacity reporting and planning.
Represent the SOC's operational position on client and commercial decisions that change what we resolve conflicts between SOC standards and client commitments.
Drive detection quality, threat hunting, and incident response effectiveness; assume incident command on declared incidents when required.
Lead, coach, and develop the SOC Desk Manager and SOC Technical Lead, and through them all SOC tiers; hire, onboard, and manage performance of SOC staff.
Champion AI and automation in SOC workflows while preserving human oversight of critical decisions.
Communicate regularly with clients, the team, and executive leadership.
What Success Looks Like in the First 12 Months
Every tier performs its documented role, training is delivered on schedule, and gaps in the standard or in compliance with it are recognized and corrected.
SOC operating standards are enforced consistently across all shifts, deviations are documented and approved, and standards are reviewed and improved on a cadence.
SLA and KPI reporting runs on its cadence to clients and leadership, service levels are met or misses have documented corrective action, and capacity reporting and planning drive staffing and intake decisions.
Both managers own daily operations and have grown as leaders; your time goes to direction, clients, and leadership.
Detection and response measurables are sustained or improved against baseline, and hunting and detection validation operate on schedule.
No SOC client is surprised by a coverage gap: coverage boundaries and client responsibilities are stated in every service review.
Required Qualifications
Experience
Minimum eight years in information security and/or IT, including significant SOC experience in an enterprise or MSP/MSSP environment and at least three years leading a SOC or comparable team.
Demonstrated experience running a security operations function or comparable 24/7 operation, internal or client-facing, accountable for its outcomes, capacity, and standards.
Experience managing performance against SLAs or service-level expectations and KPIs, and leading and developing managers and technical leads.
Education
Bachelor's degree in Information Technology, Information Security/Assurance, Computer Science, or equivalent experience. Master's degree a plus.
Technical Qualifications
Deep familiarity with SIEM, SOAR, incident response, firewall management, and vulnerability management.
Familiarity with applying AI and automation in a SOC, with sound judgment about where human oversight remains essential.
Required Certifications
None required. CISSP or CISM strongly preferred; CISSP-ISSMP a plus.
Preferred Qualifications
CISSP or CISM; CISSP-ISSMP a plus.
Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012 incident reporting obligations.
Experience building or scaling a SOC or managed security service.
Capabilities and Professional Attributes
Decisive: makes, communicates, and holds to decisions, and documents them clearly and promptly.
Leads through managers and develops leaders.
Represents an operational position to executives and clients with reasons and alternatives.
Integrity: ethical and respectful to clients and team.
Grit: self-motivates, self-manages, and meets deadlines when faced with competing priorities.
Customer-centric: partnership with our clients is a win-win scenario.
Selfless: when one team member succeeds, we all succeed.
Work Environment
Onsite in Huntsville, Alabama, in an office setting within and adjacent to the 24/7 SOC.
Weekday business hours, with availability for escalation outside them.
Client-facing: regular communication with client technical and executive contacts.
Occasional travel for client meetings and industry events.
Must be a U.S. person; the SOC is staffed by U.S. personnel.
Physical demands are representative of an office environment.
Why MAD Security
Mission that matters: our clients build and support what the warfighter depends on, and the SOC is how we protect the systems that enable them.
A real, in-person 24/7 SOC in Huntsville, Alabama, staffed by U.S. personnel working in the same room, at a time when most of the industry has gone fully remote.
A company that holds itself to the standard it sells: MAD Security is CMMC Level 2 certified, an authorized C3PAO, and has been a Registered Provider Organization since the program began; our SOC platform runs on Elastic Cloud Gov, which is FedRAMP Moderate authorized.
A modern platform direction: Elastic Security as the SIEM, detection as code, and agentic triage with human oversight, with the people on the floor shaping how AI is used rather than having it imposed on them.
Direct access to leadership and real ownership. Standards you write get published and enforced; decisions you make get backed.
A culture built on ten characteristics of every MAD Security professional, starting with customer service and satisfaction first and expertise as our specialty.
10 Characteristics of Every Professional at MAD Security
Customer Service and Satisfaction First. Understanding and satisfying our customers is the cornerstone to our success.
Expertise is our Specialty. Technical competence is essential to our service-oriented structure; we keep our knowledge current.
Do and Deliver More Than Expected. Deliverables before they are due, of higher quality than anticipated, and under budget.
Deliver on What We Say and What We Can Do. Before we say we can do something, we make sure we can.
Communicate Effectively. Clearly, concisely, thoroughly, and accurately, whether verbal or written.
Follow Exceptional Guiding Principles. High ethical values, good manners, honesty and fairness in all dealings.
Praise Our Co-workers. Humble and generous in praise for others.
Share Knowledge. Information is not a limited resource; we learn something new daily and pass it on.
Express Gratitude. We thank others in a meaningful way.
Maintain the Right Attitude. Pleasant even during trying times.
Other Duties
This job description describes the general nature and level of work to be performed. It is not a comprehensive list of duties, responsibilities, and qualifications. MAD Security, LLC reserves the right to amend responsibilities to meet business and organizational needs, with or without notice.
About MAD Security, LLC
MAD Security, LLC, founded in 2010, is a veteran-owned cybersecurity provider headquartered in Huntsville, Alabama, and recognized as a Top 250 MSSP by MSSP Alert, as well as an Inc Best Places to Work. We deliver managed security, governance, risk and compliance, and CMMC services to the Defense Industrial Base and other regulated industries, including aviation and aerospace, government contractors, financial institutions, technology service providers, higher education, and manufacturing. Our tagline says it plainly: we defend those that defend the mission.