Get to know the Security Services Team

We are the team our clients trust to be their eyes and ears around the clock, watching over their environments even when their own teams are offline. Our MDR function spans real-time monitoring and alert triage, threat detection and investigation, and incident analysis and response guidance, using the EDR, SIEM, IPS, WAF, and firewall platforms deployed across our client base to catch what automated rules miss and help clients stop incidents before they become breaches.

We don't just close tickets. Our analysts tune detection logic, document what they see, and escalate with the context client stakeholders need to act fast. If you want to build deep, hands-on detection and investigation experience across a wide range of client environments, and be part of a team that backs each other up on every shift, you'll be in good company here.

The Opportunity

Workstreet is seeking a Security Operations Center (SOC) Manager to join our Security Services team. You will own the day-to-day operation of a 24x7 SOC that monitors client environments, and you will manage a team of 10 or more SOC analysts across rotating shifts. The SOC investigates alerts, delivers findings and remediation guidance, and escalates to client stakeholders, who carry out the actual response in their own environments.

This is a working leadership role. You will build the schedule, set the quality bar for investigations, coach analysts, and stay close enough to the tooling (EDR, firewall, IPS, WAF, and SIEM) to judge detection quality yourself. You will also be a visible point of contact for clients on service performance and escalations. The successful candidate will take ownership of shift coverage, team performance, and client-facing SOC delivery within their first 60 days.

What you'll do

Team Leadership

• Lead, coach, and develop a team of 10 or more SOC analysts, with regular one-on-ones, clear goals, and honest performance feedback.
• Build and maintain the 24x7 shift schedule so every shift has the right coverage and skill mix, including nights, weekends, and holidays.
• Recruit, interview, and onboard new analysts, and run a training program that gets them investigating independently quickly.
• Set career paths and development plans for analysts, and support certification and training goals.
• Manage burnout and retention risks that come with round-the-clock operations.

SOC Operations

• Own SOC performance against client SLAs, tracking metrics such as time to acknowledge, time to investigate, escalation quality, and false positive rate.
• Review investigations and escalations for accuracy, completeness, and clarity before they reach clients, and coach analysts on gaps.
• Oversee monitoring across EDR, firewall, IPS, WAF, and SIEM platforms, and prioritize detection tuning to reduce noise and close coverage gaps.
• Maintain SOC runbooks, playbooks, and shift handoff procedures so open investigations never stall between shifts.
• Run post-incident reviews and drive lessons learned back into detections, procedures, and training.

Client Management

• Serve as the senior point of contact for clients on SOC service delivery, escalations, and incident communications.
• Lead recurring service reviews that cover alert volume, notable incidents, trends, and recommended improvements.
• Work with clients during onboarding to scope log sources, tooling, escalation paths, and response responsibilities.
• Handle client concerns and escalations with urgency and composure, and make judgment calls without waiting for direction.

Reporting & Cross-Team Collaboration

• Report SOC performance, staffing, and risk to Workstreet leadership on a regular cadence.
• Partner with Workstreet's GRC engineers and vCISOs so detection and response activity supports client compliance obligations (e.g., SOC 2, ISO 27001, HIPAA).
• Identify opportunities to improve tooling, automation, and process, and make the business case for them.

Who you are

• 7+ years of security operations experience, including 3+ years managing a SOC team or comparable security operations function.
• Has run a 24x7 SOC operation and knows how to keep coverage, quality, and morale steady across shifts.
• Experience leading teams of 10 or more analysts, including hiring, performance management, and scheduling.
• Strong working knowledge of EDR, firewall, IPS, WAF, and SIEM platforms, with enough hands-on depth to review an investigation and spot what was missed.
• Comfortable owning client relationships and explaining incidents, trends, and SLA performance to technical and executive audiences.
• Makes sound decisions under pressure and stays composed when an escalation is active.
• Writes and speaks clearly, and holds analysts to the same standard in their reports and client communications.
• Willing to work flexible hours when needed to support coverage, escalations, or shift transitions.

What help you succeed

• Active security or leadership certifications, such as CISSP, CISM, GCIH, GCIA, or equivalent.
• Prior MSSP experience supporting multiple client environments at once.
• Hands-on administration of security toolsets, including configuring, maintaining, and tuning EDR, SIEM, firewall, IPS, or WAF platforms.
• Experience with automation, such as scripting (e.g., Python, PowerShell) or SOAR playbook development, to reduce manual triage and reporting work.
• Familiarity with compliance frameworks such as SOC 2, ISO 27001, or HIPAA, and how SOC activity supports audit readiness.
• Experience building SOC metrics, dashboards, and reporting for clients and leadership.

What we offer

• Career Development: Clear path with mentorship and training opportunities.
• Role-Related Training: Reimbursement for the successful completion of approved training and certification courses relevant to your current role.
• Competitive Compensation: A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
• Growth Opportunity: Early-stage company with significant room for career advancement.
• Remote-First Culture: Flexibility to work from anywhere while collaborating with a global team.

What you'll need to thrive

• Excellent written and verbal English communication skills, with the ability to engage confidently with analysts, clients, and leadership across global teams.
• A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, incident calls, and uninterrupted collaboration.
• Availability for management coverage across the 24x7 SOC, including escalations that arise outside standard business hours. Occasional flexibility to adjust working hours is expected to support the team and clients.
• Willingness and ability to travel locally for occasional onsite meetings, client reviews, team gatherings, or business activities as needed.

Hiring and Selection Process

• Candidates must participate in live video interviews throughout the hiring process with camera on (non-negotiable) and be prepared to verify their identity during recruitment and onboarding.
• Employment is contingent upon successful completion of identity verification and background screening, where permitted by law.
• Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders to assess role fit, experience, and alignment with Workstreet's operating principles.
• Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step.

Workstreet Is An Equal Opportunity Employer

As an equal opportunity employer, Workstreet is committed to providing employment opportunities to all individuals. All applicants for positions at Workstreet will be treated without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.