Sr. Security Operations Center Manager

Senior Security Operations Center (SOC) Manager

Greenwood Village, CO.

Hybrid

Salary Range $175,000K-$185,000K

Why Choose GMR?Global Medical Response(GMR) and its family of solutions are dedicated to delivering compassionate, quality medical care, primarily in the areas of emergency and patient relocation services.Here you'll embark on meaningful work that will make an impact on you and the customers we serve.View the stories on how our employees provide care to the world atwww.AtaMomentsNotice.com.

GMR's Core Behaviors-keep care at the center, raise your hand,seekto understand, find a way together and be accountable-uniteour teamsand set us apart in emergency medical services.

POSITION SUMMARY

Under the guidance of the Chief Information Security Officer (CISO) and Director of Cyber Security Operations, the Senior Security Operations Center (SOC) Manager is responsible for the day-to-day defense of the enterprise and the operational readiness of the SOC. Working closely with Cyber Security, Infrastructure, Cloud, and business partners, this leader oversees threat monitoring, detection, response, and incident management while ensuring effective team performance and continuous improvement.

The Senior SOC Manager leads the Security Operations Center, directs detection and response activities, and serves as incident commander during significant security events. This hands-on leadership role requires technical expertise, strategic vision, and the ability to build high-performing teams, foster cross-functional partnerships, mature security operations, and translate complex cyber risk into actionable business decisions.

CORE RESPONSIBILITIES

Security Operations Leadership

• Own the 24x7x365 operational security posture of the enterprise, including monitoring, shift coverage, escalation, handoff quality, and operational readiness.
• Lead, coach, and develop SOC personnel while fostering accountability, teamwork, continuous learning, mutual respect, and operational excellence. Manage hiring, performance, career development, and retention.
• Establish and enforce service levels for triage, investigation, incident response, and escalation across alert severity tiers.
• Serve as the senior operational authority during security incidents, including after-hours events and major business disruptions.
• Build trusted partnerships across Infrastructure, Cloud, Identity, Network, Applications, Compliance, and business teams to improve security outcomes and organizational resilience.
• Mentor analysts, engineers, and emerging leaders while maintaining career development and succession plans for key security roles.

Detection and Response

• Direct monitoring across endpoint, network, identity, email, cloud, and SaaS telemetry.
• Own the incident response lifecycle end to end, including detection, triage, containment, eradication, recovery, and after-action review.
• Act as incident commander for high-severity events and lead root cause analysis, ensuring corrective actions are assigned, tracked, and completed.
• Maintain and exercise incident response plans, playbooks, and communication procedures.

Detection Engineering and Continuous Improvement

• Own detection content quality, including MITRE ATT&CK coverage mapping, alert tuning, and retirement of low-value detections.
• Reduce manual effort through automation, orchestration, and responsible adoption of AI-assisted security capabilities, and measure the resulting improvement.
• Partner with engineering and infrastructure teams to close logging, telemetry, and visibility gaps.
• Continuously improve detection capabilities through threat intelligence, threat modeling, adversary emulation, purple team exercises, and lessons learned from security events, with emphasis on threats relevant to healthcare, EMS, and aviation operations.
• Measure detection effectiveness against evolving threats and industry best practices.
• Establish proactive threat hunting capabilities to identify and disrupt malicious activity before alert-driven detection.

Healthcare and Regulatory Compliance

• Support HIPAA Security Rule obligations, including breach assessment inputs and evidence requests for the Privacy Office.
• Support CMMC and DoD requirements applicable to federal programs and contracts.
• Support SOX IT general controls and audit evidence requests in a public-company environment.
• Coordinate with clinical, aviation, and ground and fleet stakeholders on risks affecting connected medical devices, dispatch and CAD systems, ePCR platforms, and operational technology.

Vendor and Program Management

• Manage MDR, MSSP, and security technology vendor relationships, including performance against contractual service levels.
• Partner with the Director of Cyber Security Operations on SOC budget planning, capacity forecasting, and headcount justification.
• Evaluate, recommend, and optimize security technologies and operational capabilities, retiring tools that do not provide sufficient value.

Executive Communications

• Deliver monthly and quarterly SOC metrics and risk reporting that non-technical executives can act on.
• Provide clear, concise, and factual status during active incidents, without presenting speculation as fact.
• Translate complex technical risks into actionable business decisions and build consensus while balancing security, operational, and business priorities.
• Contribute to board, audit committee, regulatory, and executive reporting through Cyber Security leadership.

EDUCATION, LICENSING, AND CERTIFICATIONS

• Bachelor's degree in Computer Science, Information Security and Risk Management, Information Systems, Engineering, or a related discipline. Six years of security-related experience may be substituted for the degree.
• Leadership and Governance: CISSP preferred.
• Operational Security: SSCP, CySA+, GCIH, or comparable certifications preferred.
• Relevant certification or demonstrated equivalent expertise preferred.

EXPERIENCE

• Minimum eight years of information security experience.
• Minimum three to five years leading security operations, incident response, detection engineering, or threat management teams.
• Experience operating in highly regulated environments such as Healthcare, Financial Services, Government, or Defense preferred.

KNOWLEDGE AND SKILLS

• Experience managing MDR, MSSP, or co-managed SOC relationships and security vendors.
• Experience in healthcare, EMS, aviation, or another mission-critical or safety-of-life environment preferred.
• Strong incident response, threat detection, threat management, and security operations expertise.
• In-depth understanding of cyber threats, attack techniques, threat actors, risk management, and incident management principles.
• Working knowledge of Windows, Linux, Unix, cloud platforms, identity technologies, and modern enterprise security architectures.
• Ability to develop meaningful metrics, dashboards, documentation, and executive-level communications.
• Demonstrated leadership and stakeholder management skills, including the ability to build and retain high-performing teams, influence across organizational boundaries, resolve conflict, and communicate effectively with technical and executive audiences.
• Strong collaboration and partnership skills, with a proven ability to establish trust and shared ownership across Cyber Security, Infrastructure, Engineering, Compliance, and business teams.
• Experience leading enterprise-wide security incidents involving multiple technology and business stakeholders.
• Experience developing security operations strategy, roadmaps, and operational maturity programs while balancing tactical demands with long-term objectives.

• Salary Range $175K-$185K Range
• Check out our careers siteBenefits | GMR Careersto learn more about our comprehensive benefit options, which include medical, vision, dental, 401k, disability, FSA, HSA, EAP, vacation and paid time off.
• The application window for this position is anticipated to close on 10.3.2026

Check out our careers site benefits page to learn more about our benefit options.