Lead SOC Engineer

Lead SOC Engineer

Second Front Systems is looking for a hands-on, high-ownership, builder Lead SOC Engineer to strengthen our Security Operations Center, from detection logic to incident response.

Operating at the intersection of security operations, engineering, government customers, and the mission—translating continuous threat detection and compliance posture into hardened deployment pipelines while aligning with warfighter readiness and accreditation velocity, you will be responsible for leading threat detection and response across cloud-native infrastructure, shaping how we detect and responding to threats, and building a small team alongside you.

You will write detections as code, engineer logging pipelines, automate response via SOAR and Python/Terraform, lead incidents end to end, run threat hunts, and coach early-career analysts, ensuring that alerts mean something, a small team operates like a bigger one, and concrete fixes ship from blameless post-mortems.

We need someone capable of building and tuning detection logic across AWS, Kubernetes, identity, and endpoints with a SIEM and EDR; automating repetitive triage and response work with SOAR playbooks, Python, and Terraform; and leading technical teams and mentoring through hands-on incident response and threat hunts.

As a key partner to engineering, platform, IT, and an MDR provider, you will establish a practical 6–12 month SOC roadmap, track operational measures (MTTD/MTTR, detection coverage, false-positive rate), and hold vendors to a high technical bar, serving as the person who turns where we are into where we need to be, one shipped improvement at a time.

Note: Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia

• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Build and tune detection logic across AWS, Kubernetes, identity, and endpoints, treating detections as code with version control, testing, and review.

• Engineer logging pipelines: onboard log sources, maintain telemetry collection, and close gaps in cloud and container observability.

• Automate response work by writing SOAR playbooks and Python/Terraform tooling for enrichment, triage, and incident containment.

• Lead incidents from triage through investigation, containment, and recovery, then run blameless post-mortems that drive engineering fixes.

• Conduct hands-on threat hunts based on defense and cloud-native threat intelligence, translating findings into new detections.

• Coach early-career analysts through runbooks, pairing sessions, detection reviews, and on-call readiness to uplevel the team.

• Own a practical SOC roadmap sequencing 6–12 months of capability work in tooling, coverage, and process, then deliver it aggressively.

• Track operational measures—MTTD/MTTR, detection coverage, false-positive rate—and use them to decide what to fix next.

• Translate security findings from Trivy, Grype, and Watchtower monitoring into engineering-actionable remediation tasks within GitLab, prioritizing mission-critical vs. acceptable-risk by severity and warfighter impact.

• Broker between government customer compliance officers and Game Warden platform engineers on ATO requirements, translating FedRAMP High and DoD IL2–IL6 control mappings into platform hardening work and continuous authorization strategy.

• Synchronize incident response workflows across security triage, engineering on-call rotations, and mission owner communication channels using Tines automation and Okta access controls to maintain operational tempo during active threats.

What You Bring

• 7+ years of hands-on experience in security operations, detection engineering, incident response, or cloud security engineering, with demonstrated technical leadership or senior individual contributor role mentoring others.

• Hands-on depth with a SIEM and EDR: you have written and tuned detections, built content, and moved beyond tool administration.

• Strong AWS security fundamentals including CloudTrail, GuardDuty, IAM, and VPC flow logs, with understanding of how attacks surface in cloud telemetry.