Lyra Technology Group is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group, we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.

Lead SOC Engineer – ImageQuest

ImageQuest is looking for an experienced Lead SOC Engineer to serve as the technical backbone of our Security Operations Center. This is a senior technical role focused primarily on escalations and incident response, security tooling ownership, proactive threat hunting, and scripting and automation within a managed services environment. The Lead SOC Engineer is the SOC's primary escalation point, owning confirmed compromises from containment through handoff to the Advisory Services team. The ideal candidate is comfortable building deep, custom policy on the tools our analysts and clients depend on, hunting for threats that automated tooling misses, and reducing manual SOC workload over time.

About ImageQuest….

ImageQuest is a Nashville, Tennessee-based managed IT and managed security services provider serving regulated businesses across the United States, including banking, healthcare, insurance, legal, non-profit, and wealth management organizations. Founded in 2007, the company delivers managed IT, cybersecurity, incident response, virtual CISO leadership, compliance consulting, and cloud support, all with a proactive, compliance-focused approach. ImageQuest is part of Lyra Technology Group.

Your work as a Lead SOC Engineer will include several components

Escalation & Incident Response

Own all escalations and confirmed compromises referred from the SOC Analysts.
Investigate and triage escalated alerts to determine severity, scope, and whether a compromise is confirmed.
Contain and resolve security incidents before they affect client business operations.
Manage internal communication during suspected and confirmed incidents, and work directly with clients to explain the containment and investigation process under time constraints.
Serve as backup to the SOC Analysts in responding to inbound alerts as needed.
Conduct post-incident debriefs with the Cybersecurity Advisory team.

Threat Hunting & Security Monitoring

Conduct proactive threat hunting across the client base rather than relying solely on inbound alerts.
Continually monitor security intelligence and threat chatter that may affect ImageQuest clients.
Maintain a current understanding of the threat landscape relevant to ImageQuest's client industries.

Spam Filter & Phishing Escalation

Serve as the escalation point for Defender for Office, IronScales, and Mimecast configuration and tuning.
Own escalated phishing investigations referred from the SOC Analysts, determining scope and whether further containment is needed.
Adjust spam filter policy, including sender and domain blocks, allow lists, and quarantine rules, in response to confirmed phishing campaigns.
Coordinate directly with clients on high-impact phishing incidents requiring same-day action.

Endpoint & Tooling Ownership

Configure and maintain Microsoft Defender for Endpoint, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf across the client base.
Build deeper, custom ThreatLocker policy beyond the standard baseline maintained by the SOC Analysts, precise enough to block real threats without breaking legitimate client applications.
Investigate tooling gaps and false positives, tuning detection rules to reduce noise reaching the Analyst queue.

Automation & Process Improvement

Drive scripting and automation improvements across the SOC's alert and ticketing tools to reduce manual, repetitive work.
Establish and maintain accurate documentation of SOC processes and incident responses.
Pull monthly reports and categorize SOC activity appropriately.