Note: The job is a remote job and is open to candidates in USA. Florida Gulf Coast University is seeking a Security Operations Center Lead to oversee the daily operations of their Security Operations Center. This role involves managing cybersecurity monitoring, incident response, and providing mentorship to student analysts while collaborating with various university departments to enhance cybersecurity efforts.
Responsibilities
- Leads day-to-day Security Operations Center (SOC) activities, including security monitoring, alert triage, investigation, escalation, incident response coordination, operational reporting, and analyst shift oversight
- Participates in after-hours incident response, emergency escalation, and on-call support as needed to address significant cybersecurity events or operational requirements
- Recruits, hires, trains, mentors, and supervises undergraduate and graduate student analysts. Provides ongoing coaching, performance feedback, and career development support
- Develops and maintains a structured student analyst training program covering alert triage, SIEM operations, threat detection, MITRE ATT&CK methodologies, digital forensics fundamentals, investigation procedures, and incident response workflows
- Develops or supports cybersecurity exercises, tabletop scenarios, and incident response drills to evaluate readiness and improve coordination among SOC personnel, ITS teams, and university stakeholders
- Establishes analyst progression standards, operational guardrails, and escalation thresholds to ensure student analysts operate within approved authority and documented procedures
- Performs security monitoring, investigation, and incident response activities as needed to maintain SOC operations during periods of reduced student staffing or elevated operational demand
- Reviews, validates, and directs security investigations, ensuring security events are properly analyzed, documented, escalated, and communicated in accordance with established policies, procedures, and response playbooks
- Serves as the operational lead during significant cybersecurity incidents, coordinating response activities with Information Technology Services (ITS), university leadership, legal counsel, human resources, communications personnel, and external partners as appropriate
- Maintains and improves detection, monitoring, and response capabilities across security technologies, including SIEM, endpoint detection and response (EDR), cloud security platforms, and related cybersecurity tools
- Develops, maintains, and updates SOC playbooks, standard operating procedures, workflows, and documentation to support consistent and effective security operations
- Manages relationships with managed security service providers (MSSPs), incident response vendors, and other external security partners to support monitoring, investigation, and response activities
- Supports security operations and incident response activities involving regulated or sensitive institutional data, including data subject to FERPA, GLBA, PCI DSS, HIPAA where applicable, and university policies
- Escalates actionable cybersecurity risks, incidents, and operational concerns to the Chief Information Security Officer (CISO) and other designated stakeholders
- Maintains security operations documentation and reports on security metrics, incident trends, operational performance, and student program outcomes
- Conducts or supports audits, compliance activities, and security reviews
- Conducts post-incident reviews and broader security process evaluations to identify lessons learned, document corrective actions, and recommend improvements to detection logic, response procedures, communication workflows, and operational controls to enhance overall SOC effectiveness and operational efficiency. Communicates technical security findings, risks, and operational impacts in clear, non-technical language suitable for university leadership and business stakeholders
- Contributes to broader information security initiatives including cloud security, identity and access management, security awareness, and emerging technology governance efforts
Skills
- This position requires nine years of directly related full-time experience or, as an alternative, a Bachelor's degree from an accredited institution in Cybersecurity, Computer Science, Informatics, Information Systems, or related field and five years of full-time experience directly related to the job functions
- Experience with SOC operations, security monitoring, incident response, or related cybersecurity functions, including conducting cybersecurity investigations, alert triage, or security event analysis
- Experience with enterprise SIEM, EDR, or similar platforms
- Experience utilizing Microsoft security tools, including Microsoft Entra ID, Microsoft Sentinel, Active Directory, Microsoft Defender, Microsoft 365 security features or comparable enterprise security tools
- Any appropriate combination of relevant education, experience, and/or certifications may be considered
- Five years full time experience in cybersecurity operations, incident response, or threat detection
- Two years experience in managing, coaching, or mentoring technical staff or junior analysts
- Familiarity with NIST CSF, NIST 800-53, FERPA, and HIPPA
- Experience working in Higher Education
- Familiarity with Higher Education technologies, including Banner, Workday, Canvas, Blackboard, and research computing infrastructure
- Experience designing security training or formal curricula
- Experience with Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, Microsoft Purview, or related Microsoft security technologies
- Experience with SOAR platforms
- CISSP, CISM, Security+, GCIH, GCIA, CISA, or similar certifications
Company Overview