Any one of CASP, CCSP, SSCP, GMON, GCIH, GCIA, or GCED plus a DoD 8570/8140 CSSP Analyst, Infrastructure Support, or Incident Responder certification. Lead SOC operations, monitor security events, coordinate incident response, mentor analysts, ensure SLA compliance.