| Location | Rock Springs, WY |
| Job Title | SOC & Incident Response Lead | ||||||||
| Client Company/Dept. Name | Western Wyoming Community College | ||||||||
| Address | 2500 College Drive, E-460 | City Name | Rock Springs | State Name | WY-Wyoming | Zip Code | 82901 | If others (Address) | |
| Duration of the project | Project Start Date | Nov. 13, 2026 | Project End Date | 3-year initial term, with renewal options | Due date for Resume submission | 10/15/2026 | |||
| No. of Openings | 1 | No. of Maximum Submissions | 1 | ||||||
| Job Description | Role summary: Runs the security monitoring service WWC asked for in Addendum 3, Q14: continuous threat monitoring, detection, alerting, escalation and incident support. Owns how alerts are triaged and escalated to WWC staff, and leads technical incident response. Reports to: vCISO Works with: WWC information security analyst and systems/network administrators; Service Desk Manager for user-reported incidents Location: US-based; remote, with onsite incident response available Allocation: 0.5 FTE leadership of a 24/7/365 monitoring operation; on-call escalation point Key responsibilities: • Design and run 24/7/365 security monitoring and threat detection for WWC: hours of active monitoring, technology, alert triage and escalation, and the response actions WWC pre-approves. • Onboard WWC log sources into SIEM/XDR, preferably Microsoft Sentinel and Defender XDR under M365 A5: Entra ID, Exchange Online, endpoints (Intune and Jamf managed), firewalls, servers and the Colleague SQL environment. • Build and tune detection use cases for higher-ed threats: credential stuffing on student accounts, business email compromise, financial aid fraud, ransomware and MFA fatigue. • Author and maintain the incident response plan, playbooks and escalation matrix aligned with NIST SP 800-61. • Lead technical incident response: containment, eradication, recovery, evidence handling and coordination with forensics or IR retainer partners. • Run annual incident response tabletop exercises with WWC leadership and IT. • Run threat hunting and threat intelligence (including REN-ISAC and CISA advisories). • Produce monthly SOC metrics: alert volumes, mean time to detect, mean time to respond, incidents and trends. Deliverables owned: the SOC service model and runbook, incident response plan and playbooks, tabletop exercise reports, monthly SOC/MDR reports, and post-incident reports. | ||||||||
| Skill set info | Experience: 12+ years in security operations, including 6+ years leading a SOC, MDR or incident response team Required qualifications: • 12+ years in cybersecurity operations, with 6+ years leading SOC, MDR or DFIR teams. • Hands-on expertise with Microsoft Sentinel (KQL), Defender XDR and Entra ID; experience with another SIEM such as Splunk or QRadar is a plus. • Led response to ransomware, business email compromise and data exposure incidents, including regulatory notification support (FERPA, GLBA, state breach laws). • Knowledge of the MITRE Telecommunication&CK framework, NIST SP 800-61 and evidence chain of custody. • Bachelor's degree in Cybersecurity or Computer Science, or equivalent experience. Preferred: SOC experience for colleges, universities or K-12 / public sector; experience running a cyber insurance-aligned IR retainer. | ||||||||
| Education | Bachelor's degree in Cybersecurity or Computer Science, or equivalent experience. | ||||||||
| Certifications (if required) | Certifications (required: at least one of): GIAC GCIH, GCIA or GCFA; CISSP. Preferred: Microsoft SC-200, GIAC GNFA, EC-Council ECIH. | ||||||||
| Documentation Required for submission | Updated Resume | ||||||||
| Work Hours | 0.5 FTE leadership of a 24/7/365 monitoring operation; on-call escalation point | ||||||||
| Account Manager Name (Proposal Team) | |||||||||
| Work authorization required | USC/GC/EAD/H1 also | ||||||||
| Relocation is accepted | No | ||||||||
| Remote work | Yes, remote is fine. Onsite incident response available as needed | ||||||||
| Additional Notes if any | Candidate can be based anywhere in the US. Being located in or near Rock Springs, Wyoming is a preference only, not a requirement. Must be available for onsite incident response if needed. | ||||||||
By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Privacy Policy - Abacus.