EXOS
Indianapolis, Indiana
Job Description What You Will Do The Security Operations Center (SOC) Manager at EXOS leads the SOC. You own how we detect, respond to, and report on threats across every client environment we protect. You also lead the team that does that work every day: Cybersecurity Analysts at Tiers 1, 2, and 3, and a Cybersecurity Engineer who owns our security tooling. This is a player-coach role. You will step into the hardest investigations, run incident response when it matters most, and bring a forensics and offensive security mindset to how we build and validate detections. You will also hire, coach, and grow the team, and partner with EXOS Cyber leadership on service strategy. The role is built for a leader with 8+ years in security operations and incident response who enjoys building a team as much as closing a hard case. Lead day-to-day SOC operations across a multi-tenant client base. Own queue health, shift coverage, escalation paths, and SLA performance for response, escalation, and client communication. Serve alongside the incident commander for major incidents, including ransomware, business email compromise, account takeover, and data exfiltration. Assist with scoping, containment, eradication, recovery, and client communication through resolution. Assist in after-action reviews that turn every significant incident into concrete improvements in detections, playbooks, and client guidance. Guide timeline reconstruction, evidence preservation, and chain of custody. Support breach notification, legal, and cyber insurance coordination when an incident calls for it. Lead purple team and adversary emulation exercises with the Analyst III and Cybersecurity Engineer, and turn attacker TTPs into detections we validate end to end. Lead and develop the SOC team. Hire, onboard, coach, and run one-on-ones and performance reviews for the Cybersecurity Engineer and Analysts I, II, and III. Build clear development plans that support our promote-from-within, tier-based career path. Set direction for the security stack with the Cybersecurity Engineer. Prioritize tooling updates, gap assessments, and recommendations across tools such as SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform. Own detection strategy at the program level. Track coverage against MITRE ATT&CK, prioritize tuning and new use cases, and partner with the AI Automation Engineers to operationalize playbooks through automation. Build SOC process maturity through runbooks, playbooks, investigation standards, QA reviews, and shift handoffs. Report on the metrics that show how the service is performing, including MTTA, MTTR, escalation accuracy, and false positive rate. Lead security reviews and QBRs, present monthly reporting on what we saw, what it means, and what we recommend, and translate technical findings into business decisions. Partner with Account Management, Service Delivery, and EXOS leadership on client onboarding, capacity planning, and scoping for new managed security engagements. What You Have Done 8+ years in security operations, incident response, or MSP/ MSSP security roles, including 3+ years leading a SOC, IR team, or security engineering team. Proven experience as incident commander on confirmed incidents such as ransomware, business email compromise, and account compromise, from first alert through recovery and after-action review. Hands-on digital forensics and incident response background, including host, memory, and network forensics, timeline reconstruction, and evidence handling. Penetration testing, red team, or adversary emulation experience, and the ability to apply that attacker perspective to detection and defense. Advanced command of an EDR (SentinelOne, CrowdStrike, or Defender for Endpoint) and a SIEM (Splunk, Sentinel, Blumira, or QRadar) at the query, pivot, and detection-authoring level. Working knowledge of network and perimeter controls, including next-generation firewalls (Cisco Firepower, Cisco ASA), DNS-layer security (Cisco Umbrella, DNSFilter), and cloud email security (Avanan or similar). Experience building SOC processes from the ground up: runbooks, playbooks, escalation criteria, QA programs, and operational metrics. A track record of hiring, coaching, and developing analysts and engineers, with the ability to give kind and direct feedback and grow people into their next role. Strong fluency in the incident response lifecycle, MITRE ATT&CK, and frameworks such as NIST CSF, NIST SP 800-61, and CIS Controls. Excellent written and verbal communication, including executive-ready incident reports and the steadiness to guide client leadership through a major incident. Comfort owning SLAs and priorities across many clients at once, and availability to lead the team through after-hours incidents. CISSP or CISM, plus GIAC GCIH (or an equivalent incident handling certification). Preferred Qualifications Bachelor's or master's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline. Equivalent military training or certifications considered. CISSP, CISM, SANS LDR/MGT551 Forensics certifications such as GIAC GCFA, GCFE, or GNFA, and offensive credentials such as OSCP, GPEN, or PNPT. Prior MSP or MSSP experience in a multi-tenant model, including a multi-tenant PSA or ticketing platform (ConnectWise, Autotask, ServiceNow, or similar). Experience leading security operations across multiple sites and client tenants, including distributed or multi-location SOC teams. Direct experience with our stack: SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and security awareness training platforms. Experience with SOAR or automation-driven SOC operations, and comfort working alongside an AI Automation Engineer. DFIR tooling depth (Velociraptor or comparable) and experience working with legal counsel, cyber insurance carriers, and breach coaches during major incidents. Experience supporting clients with compliance requirements such as SOC 2, HIPAA, PCI DSS, or CMMC. Experience building SOC training programs and tiered analyst career paths.
Job Description What You Will Do The Security Operations Center (SOC) Manager at EXOS leads the SOC. You own how we detect, respond to, and report on threats across every client environment we protect. You also lead the team that does that work every day: Cybersecurity Analysts at Tiers 1, 2, and 3, and a Cybersecurity Engineer who owns our security tooling. This is a player-coach role. You will step into the hardest investigations, run incident response when it matters most, and bring a forensics and offensive security mindset to how we build and validate detections. You will also hire, coach, and grow the team, and partner with EXOS Cyber leadership on service strategy. The role is built for a leader with 8+ years in security operations and incident response who enjoys building a team as much as closing a hard case. Lead day-to-day SOC operations across a multi-tenant client base. Own queue health, shift coverage, escalation paths, and SLA performance for response, escalation, and client communication. Serve alongside the incident commander for major incidents, including ransomware, business email compromise, account takeover, and data exfiltration. Assist with scoping, containment, eradication, recovery, and client communication through resolution. Assist in after-action reviews that turn every significant incident into concrete improvements in detections, playbooks, and client guidance. Guide timeline reconstruction, evidence preservation, and chain of custody. Support breach notification, legal, and cyber insurance coordination when an incident calls for it. Lead purple team and adversary emulation exercises with the Analyst III and Cybersecurity Engineer, and turn attacker TTPs into detections we validate end to end. Lead and develop the SOC team. Hire, onboard, coach, and run one-on-ones and performance reviews for the Cybersecurity Engineer and Analysts I, II, and III. Build clear development plans that support our promote-from-within, tier-based career path. Set direction for the security stack with the Cybersecurity Engineer. Prioritize tooling updates, gap assessments, and recommendations across tools such as SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform. Own detection strategy at the program level. Track coverage against MITRE ATT&CK, prioritize tuning and new use cases, and partner with the AI Automation Engineers to operationalize playbooks through automation. Build SOC process maturity through runbooks, playbooks, investigation standards, QA reviews, and shift handoffs. Report on the metrics that show how the service is performing, including MTTA, MTTR, escalation accuracy, and false positive rate. Lead security reviews and QBRs, present monthly reporting on what we saw, what it means, and what we recommend, and translate technical findings into business decisions. Partner with Account Management, Service Delivery, and EXOS leadership on client onboarding, capacity planning, and scoping for new managed security engagements. What You Have Done 8+ years in security operations, incident response, or MSP/ MSSP security roles, including 3+ years leading a SOC, IR team, or security engineering team. Proven experience as incident commander on confirmed incidents such as ransomware, business email compromise, and account compromise, from first alert through recovery and after-action review. Hands-on digital forensics and incident response background, including host, memory, and network forensics, timeline reconstruction, and evidence handling. Penetration testing, red team, or adversary emulation experience, and the ability to apply that attacker perspective to detection and defense. Advanced command of an EDR (SentinelOne, CrowdStrike, or Defender for Endpoint) and a SIEM (Splunk, Sentinel, Blumira, or QRadar) at the query, pivot, and detection-authoring level. Working knowledge of network and perimeter controls, including next-generation firewalls (Cisco Firepower, Cisco ASA), DNS-layer security (Cisco Umbrella, DNSFilter), and cloud email security (Avanan or similar). Experience building SOC processes from the ground up: runbooks, playbooks, escalation criteria, QA programs, and operational metrics. A track record of hiring, coaching, and developing analysts and engineers, with the ability to give kind and direct feedback and grow people into their next role. Strong fluency in the incident response lifecycle, MITRE ATT&CK, and frameworks such as NIST CSF, NIST SP 800-61, and CIS Controls. Excellent written and verbal communication, including executive-ready incident reports and the steadiness to guide client leadership through a major incident. Comfort owning SLAs and priorities across many clients at once, and availability to lead the team through after-hours incidents. CISSP or CISM, plus GIAC GCIH (or an equivalent incident handling certification). Preferred Qualifications Bachelor's or master's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline. Equivalent military training or certifications considered. CISSP, CISM, SANS LDR/MGT551 Forensics certifications such as GIAC GCFA, GCFE, or GNFA, and offensive credentials such as OSCP, GPEN, or PNPT. Prior MSP or MSSP experience in a multi-tenant model, including a multi-tenant PSA or ticketing platform (ConnectWise, Autotask, ServiceNow, or similar). Experience leading security operations across multiple sites and client tenants, including distributed or multi-location SOC teams. Direct experience with our stack: SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and security awareness training platforms. Experience with SOAR or automation-driven SOC operations, and comfort working alongside an AI Automation Engineer. DFIR tooling depth (Velociraptor or comparable) and experience working with legal counsel, cyber insurance carriers, and breach coaches during major incidents. Experience supporting clients with compliance requirements such as SOC 2, HIPAA, PCI DSS, or CMMC. Experience building SOC training programs and tiered analyst career paths.
EXOS
Indianapolis, Indiana
Job Description What You Will Do The Cybersecurity Engineer at EXOS owns the security stack that powers our SOC. You keep our detection and prevention tools healthy, current, and tuned across every client environment, and you find coverage gaps early. You report to the Security Operations Manager and serve as the engineering escalation point for Cybersecurity Analysts I, II, and III. This is a hands-on builder role. You will deploy, upgrade, and integrate tools, measure how well they protect each client, and bring clear recommendations on what to improve next. The role is built for an engineer with 5+ years in security or infrastructure engineering who enjoys making a multi-tenant stack run cleanly at scale. Own administration and health of the SOC security stack, including security tools like SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform. Plan and deliver platform updates, agent upgrades, policy changes, and version lifecycles across client tenants. Every change goes through change control with testing, a maintenance window, and a rollback plan. Deploy and onboard security tooling for new clients, including agent rollout, log source integration, policy baselines, and handoff documentation for the SOC. Onboard log sources, maintain parsing and field extractions, monitor for stalled or missing sources, and keep license and storage use on target. Build, tune, and maintain detections and correlation searches with the SOC analysts. Reduce false positive load and close coverage gaps mapped to MITRE ATT&CK. Maintain perimeter and DNS security posture. Review Cisco Firepower and ASA rule sets, IPS policies, and VPN configurations, and manage Cisco Umbrella and DNSFilter policies across tenants. Support phishing simulations and training campaigns in the security awareness platform. Identify gaps across people, process, and technology. Run regular coverage reviews for agent deployment, log sources, and policy drift, benchmark against CIS Controls and NIST CSF, and present prioritized recommendations to the Security Operations Manager. Evaluate new tools and features. Run proofs of concept, compare vendors, manage vendor support cases, and build business cases that weigh risk reduction, operational effort, and cost. Automate repetitive work with PowerShell, Python, and platform APIs, and partner with the AI Automation Engineer on SOAR playbooks and integrations. Support analysts during incidents with containment actions, emergency blocks, and tooling troubleshooting, and take part in the after-hours escalation rotation. Keep engineering documentation current, including architecture diagrams, configuration standards, tool runbooks, and client-specific deployment notes. What You Have Done 5+ years in IT or security, including 3+ years engineering or administering security platforms such as EDR, SIEM, XDR, SOAR, firewalls, IPS, Web Proxies, email security, etc. Administration of DNS-layer and email security platforms such as Cisco Umbrella, DNSFilter, and Avanan. Solid networking fundamentals, including TCP/IP, routing, switching, VLANs, DNS, DHCP, and proxy concepts. Working knowledge of Windows Server, Active Directory, Entra ID, Microsoft 365, and Linux administration. Scripting in PowerShell and/or Python, and comfort working with REST APIs. Experience running change management, testing, and documentation for production security systems. The ability to assess a control environment, spot gaps, and write clear recommendations with priority, effort, and business impact. Clear communication with analysts, managers, and client IT teams, including written change notices and post-change summaries. Relevant certifications such as CompTIA Security+, CySA+, Cisco CCNA, or equivalent experience. Preferred Qualifications Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline. Equivalent military training or certifications considered. Prior MSP or MSSP experience in a multi-tenant model, including a multi-tenant PSA or ticketing platform (ConnectWise, Autotask, ServiceNow, or similar). Multi-site and multi-tenant deployment experience, including managing agents and policies across many client consoles or a parent and child tenant structure. Vendor certifications such as Splunk Core Certified Power User or Admin, CrowdStrike CCFA, SentinelOne platform certifications, or Cisco CCNP Security. Advanced security certifications such as GIAC GSEC, GCIA, or GCDA, or CISSP. Detection engineering experience with SPL, Sigma rules, KQL, or SentinelOne query syntax. Experience with SOAR or rules-based automation, and comfort operationalizing playbooks alongside an AI Automation Engineer. Exposure to the rest of our toolset, including Blumira, Velociraptor, ConnectSecure, and NodeZero. Configuration management or infrastructure-as-code experience (Ansible, Terraform, or similar). Experience aligning security controls to frameworks such as CIS Controls, NIST CSF, SOC 2, HIPAA, or CMMC.
Job Description What You Will Do The Cybersecurity Engineer at EXOS owns the security stack that powers our SOC. You keep our detection and prevention tools healthy, current, and tuned across every client environment, and you find coverage gaps early. You report to the Security Operations Manager and serve as the engineering escalation point for Cybersecurity Analysts I, II, and III. This is a hands-on builder role. You will deploy, upgrade, and integrate tools, measure how well they protect each client, and bring clear recommendations on what to improve next. The role is built for an engineer with 5+ years in security or infrastructure engineering who enjoys making a multi-tenant stack run cleanly at scale. Own administration and health of the SOC security stack, including security tools like SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform. Plan and deliver platform updates, agent upgrades, policy changes, and version lifecycles across client tenants. Every change goes through change control with testing, a maintenance window, and a rollback plan. Deploy and onboard security tooling for new clients, including agent rollout, log source integration, policy baselines, and handoff documentation for the SOC. Onboard log sources, maintain parsing and field extractions, monitor for stalled or missing sources, and keep license and storage use on target. Build, tune, and maintain detections and correlation searches with the SOC analysts. Reduce false positive load and close coverage gaps mapped to MITRE ATT&CK. Maintain perimeter and DNS security posture. Review Cisco Firepower and ASA rule sets, IPS policies, and VPN configurations, and manage Cisco Umbrella and DNSFilter policies across tenants. Support phishing simulations and training campaigns in the security awareness platform. Identify gaps across people, process, and technology. Run regular coverage reviews for agent deployment, log sources, and policy drift, benchmark against CIS Controls and NIST CSF, and present prioritized recommendations to the Security Operations Manager. Evaluate new tools and features. Run proofs of concept, compare vendors, manage vendor support cases, and build business cases that weigh risk reduction, operational effort, and cost. Automate repetitive work with PowerShell, Python, and platform APIs, and partner with the AI Automation Engineer on SOAR playbooks and integrations. Support analysts during incidents with containment actions, emergency blocks, and tooling troubleshooting, and take part in the after-hours escalation rotation. Keep engineering documentation current, including architecture diagrams, configuration standards, tool runbooks, and client-specific deployment notes. What You Have Done 5+ years in IT or security, including 3+ years engineering or administering security platforms such as EDR, SIEM, XDR, SOAR, firewalls, IPS, Web Proxies, email security, etc. Administration of DNS-layer and email security platforms such as Cisco Umbrella, DNSFilter, and Avanan. Solid networking fundamentals, including TCP/IP, routing, switching, VLANs, DNS, DHCP, and proxy concepts. Working knowledge of Windows Server, Active Directory, Entra ID, Microsoft 365, and Linux administration. Scripting in PowerShell and/or Python, and comfort working with REST APIs. Experience running change management, testing, and documentation for production security systems. The ability to assess a control environment, spot gaps, and write clear recommendations with priority, effort, and business impact. Clear communication with analysts, managers, and client IT teams, including written change notices and post-change summaries. Relevant certifications such as CompTIA Security+, CySA+, Cisco CCNA, or equivalent experience. Preferred Qualifications Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline. Equivalent military training or certifications considered. Prior MSP or MSSP experience in a multi-tenant model, including a multi-tenant PSA or ticketing platform (ConnectWise, Autotask, ServiceNow, or similar). Multi-site and multi-tenant deployment experience, including managing agents and policies across many client consoles or a parent and child tenant structure. Vendor certifications such as Splunk Core Certified Power User or Admin, CrowdStrike CCFA, SentinelOne platform certifications, or Cisco CCNP Security. Advanced security certifications such as GIAC GSEC, GCIA, or GCDA, or CISSP. Detection engineering experience with SPL, Sigma rules, KQL, or SentinelOne query syntax. Experience with SOAR or rules-based automation, and comfort operationalizing playbooks alongside an AI Automation Engineer. Exposure to the rest of our toolset, including Blumira, Velociraptor, ConnectSecure, and NodeZero. Configuration management or infrastructure-as-code experience (Ansible, Terraform, or similar). Experience aligning security controls to frameworks such as CIS Controls, NIST CSF, SOC 2, HIPAA, or CMMC.