Lead SOC Engineer

Lead SOC Engineer

The company is looking for a hands-on, high-ownership, builder Lead SOC Engineer to strengthen our Security Operations Center, from detection logic to incident response.

Operating at the intersection of security operations, engineering, government customers, and the mission—translating continuous threat detection and compliance posture into hardened deployment pipelines while aligning with warfighter readiness and accreditation velocity, you will be responsible for leading threat detection and response across cloud-native infrastructure, shaping how we detect and responding to threats, and building a small team alongside you.

You will write detections as code, engineer logging pipelines, automate response via SOAR and Python/Terraform, lead incidents end to end, run threat hunts, and coach early-career analysts, ensuring that alerts mean something, a small team operates like a bigger one, and concrete fixes ship from blameless post-mortems.

We need someone capable of building and tuning detection logic across AWS, Kubernetes, identity, and endpoints with a SIEM and EDR; automating repetitive triage and response work with SOAR playbooks, Python, and Terraform; and leading technical teams and mentoring through hands-on incident response and threat hunts.

As a key partner to engineering, platform, IT, and an MDR provider, you will establish a practical 6–12 month SOC roadmap, track operational measures (MTTD/MTTR, detection coverage, false-positive rate), and hold vendors to a high technical bar, serving as the person who turns where we are into where we need to be, one shipped improvement at a time.

Note: Candidates must reside in one of our approved hiring hubs

• DC/Maryland/Virginia

• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Build and tune detection logic across AWS, Kubernetes, identity, and endpoints, treating detections as code with version control, testing, and review.

• Engineer logging pipelines: onboard log sources, maintain telemetry collection, and close gaps in cloud and container observability.

• Automate response work by writing SOAR playbooks and Python/Terraform tooling for enrichment, triage, and incident containment.

• Lead incidents from triage through investigation, containment, and recovery, then run blameless post-mortems that drive engineering fixes.

• Conduct hands-on threat hunts based on defense and cloud-native threat intelligence, translating findings into new detections.

• Coach early-career analysts through runbooks, pairing sessions, detection reviews, and on-call readiness to uplevel the team.

• Own a practical SOC roadmap sequencing 6–12 months of capability work in tooling, coverage, and process, then deliver it aggressively.

• Track operational measures—MTTD/MTTR, detection coverage, false-positive rate—and use them to decide what to fix next.

• Translate security findings from Trivy, Grype, and Watchtower monitoring into engineering-actionable remediation tasks within GitLab, prioritizing mission-critical vs. acceptable-risk by severity and warfighter impact.

• Broker between government customer compliance officers and Game Warden platform engineers on ATO requirements, translating FedRAMP High and DoD IL2–IL6 control mappings into platform hardening work and continuous authorization strategy.

• Synchronize incident response workflows across security triage, engineering on-call rotations, and mission owner communication channels using Tines automation and Okta access controls to maintain operational tempo during active threats.

What You Bring

• 7+ years of hands-on experience in security operations, detection engineering, incident response, or cloud security engineering, with demonstrated technical leadership or senior individual contributor role mentoring others.

• Hands-on depth with a SIEM and EDR: you have written and tuned detections, built content, and moved beyond tool administration.

• Strong AWS security fundamentals including CloudTrail, GuardDuty, IAM, and VPC flow logs, with understanding of how attacks surface in cloud telemetry.

• Working scripting and automation skills in Python and infrastructure-as-code with Terraform, plus experience with SOAR or similar automation platforms.

• Real incident response experience leading incidents end to end, including triage, investigation, containment, and recovery.

• Builder's mindset: comfortable in early-stage environments with imperfect tooling, motivated by making it better rather than inheriting finished programs.

• Clear, direct communication able to explain technical risk and blast radius to engineers and leadership without drama.

• Judgment to triage alerts under operational pressure: know which signals warrant investigation versus tuning, and defend that trade-off to engineers and leadership without false precision.

• U.S. citizenship is required for this role.

Preferred

The base salary for this position will fall between $200,000 and $215,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like

• A proactive and solutions oriented mindset

• Viewing obstacles as opportunities for growth

• Having a bias toward action and tangible, measurable results

• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

Perks of Joining Our Team

• Competitive salary

• 100% employer-paid medical, dental, and vision coverage for you and your dependents

• 401(k) with a 3% company contribution

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more

• Equity incentive plan

• New hire technology and home office stipend

• Annual professional development stipend

• Flexible paid time off, plus all federal holidays

• Generous parental leave

• Flexible remote work opportunities

• Employee referral bonus program

Visit our careers page to learn more.

Who We Are

The company (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com [link for members]

Citizenship requirement

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices

Colorado

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.