SOC Operations Architect / Senior SOC Lead at InterSources Inc in Long Beach, CA

Job description

• Job Title: SOC Operations Architect / Senior SOC Lead
• Location: Remote or Hybrid – Candidate must be located in California
• Duration: 6+ Months
• Position Overview: The consultant will help convert the security operations model into practical SOC workflows, runbooks, escalation procedures, detection requirements, telemetry integrations, and operational processes. This person will also work closely with cybersecurity vendors, campus security teams, technical teams, and leadership to review proposed designs, identify gaps, clarify ownership, and ensure the SOC service can be effectively operated and sustained.

Responsibilities

• Design and refine SOC workflows for monitoring, detection, alert triage, investigation, escalation, incident handoff, and response coordination.
• Develop SOC runbooks, playbooks, procedures, severity models, escalation logic, and operational documentation.
• Review vendor SOC/MSSP/MDR operating processes, technical designs, integrations, workflows, and implementation plans.
• Identify technical gaps, operational risks, unclear ownership, and responsibility boundaries.
• Validate monitoring use cases, detection rules, alert quality, reporting, and SOC operational metrics.
• Review security telemetry from identity platforms, endpoints, firewalls, VPNs, IDS/IPS, and other security sources.
• Support SIEM, EDR, identity, ITSM, and security platform integration requirements.
• Help determine ownership of security responsibilities across the vendor, Cyber Fusion Center, CSU campuses, and other teams.
• Support SOC pilot readiness through workflow testing, tabletop exercises, scenario validation, and issue tracking.
• Coordinate with cybersecurity vendors, CFC leadership, campus security teams, and project stakeholders.

Requirements

• Senior-level experience in SOC Operations, Security Operations, Incident Response, Detection Engineering, Security Architecture, or Cybersecurity Operations.
• Strong experience designing, establishing, transitioning, or maturing Security Operations Center (SOC) capabilities.
• Strong knowledge of SOC architecture and service integration.
• Alert triage and investigation
• Incident escalation and handoff
• Incident response coordination
• Detection use cases
• SOC workflows and operational processes
• Experience with SIEM and security platform integrations.
• Security telemetry flows
• Identity correlation
• Alert lifecycle management
• Access models
• ITSM integration
• Experience managing or working closely with MSSP, MDR, SOC, SIEM, or cybersecurity service vendors.
• Experience reviewing vendor technical designs and deliverables and identifying implementation or service gaps.
• Strong knowledge of incident severity models, escalation criteria, detection rules/use cases, SOC metrics, and reporting.
• Experience developing SOC runbooks, playbooks, procedures, workflow diagrams, or operational documentation.
• SIEM
• EDR
• Identity/IAM
• Firewalls
• VPN
• IDS/IPS
• Strong technical documentation, communication, and stakeholder-management skills.
• Experience within higher education, government/public sector, federated organizations, or large multi-entity environments.
• Experience supporting enterprise-wide or distributed SOC implementations.
• Experience coordinating security operations across multiple business units, campuses, agencies, or organizational entities.

Skills

Required

• SOC Operations
• Security Operations
• Incident Response
• Detection Engineering
• Security Architecture
• Cybersecurity Operations
• SOC architecture and service integration
• Alert triage and investigation
• Incident escalation and handoff
• Incident response coordination
• Detection use cases
• SOC workflows and operational processes