Shift Manager

As a Shift Coordinator on the CTS 24x7 Service Operations team, you will provide direct supervision to Tier 1 and Tier 2 staff across the Network Operations Center (NOC), Security Operations Center (SOC), and Service Desk during your assigned shift. You act as the technical and operational command authority during the shift. You are responsible for ensuring that events across all three functions are correctly triaged, tickets are properly assigned and tracked, incidents are escalated per defined protocols, and shift handovers preserve full situational awareness for the incoming shift.

You are responsible for confirming shift staffing coverage in real time and for adjusting assignments to accommodate last-minute absences. You are the immediate escalation path for issues that exceed the authority of the Tier 1 and Tier 2 analysts on the shift, and you escalate to the Director of Technical Service Operations for issues that exceed shift authority.

Work is conducted under the compliance frameworks that govern CTS operations, in particular ITIL 4 (Monitoring and Event Management, Incident Management, Continual Improvement), ISO/IEC 27001:2022 (Annex A logging, monitoring, and incident management controls), and PCI DSS v4.0.1 (Requirements 10 and 12.10). You will be recognized inside CTS as the shift-level owner for cross-function coordination and evidence continuity.

Responsibilities:

• Provide direct supervision to Tier 1 and Tier 2 NOC, SOC, and Service Desk analysts during the assigned shift.
• Assign work at shift start and re-balance workload throughout the shift based on ticket volume, incident severity, and individual analyst capacity.
• Confirm complete shift coverage across NOC, SOC, and Service Desk queues at shift start; adjust in real time when staff are unavailable because of sick calls, unplanned PTO, or emergency absence.
• Serve as the initial escalation point for any Tier 1 or Tier 2 analyst who needs additional authority, judgment, or cross-functional coordination.
• Track and report shift-level metrics (ticket volume, SLA adherence, incident count by severity) at shift close.

Shift Handover Discipline:

• Execute a formal shift handover at the start and end of every shift, per the protocols defined in the NOC Scope Definition and the CTS SOC Scope of Operations.
• Ensure the handover record captures, at minimum: open incidents with owner and next action; active containment actions in progress; watchlist items; active maintenance windows; tooling or coverage gaps.
• Retain handover records as ISMS evidence supporting ISO/IEC 27001:2022 A.5.10 and ITIL 4 Monitoring and Event Management practice.

Incident Management Coordination:

• Apply ITIL 4 Incident Management practice throughout the shift: validate alerts, classify severity, assign ownership, coordinate escalation, and track resolution against SLA.
• Coordinate the first 15 to 30 minutes of any SEV 0 or SEV 1 incident: declare the incident, engage the appropriate tiers, initiate stakeholder communications, and hand off to the Incident Commander or on-call Tier 3 engineer.
• Enforce severity special rules from the NOC Scope Definition (for example, loss of logging or monitoring is never a SEV 4 event; SEV 0 or SEV 1 with a recent production change requires a change correlation step).
• Ensure joint NOC-SOC coordination during Major Incidents: NOC leads operational recovery; SOC leads security investigation and containment; the Shift Coordinator maintains the shared incident bridge until the Incident Commander takes over.

Cross-Function Ticket Routing and Escalation:

• Monitor NOC, SOC, and Service Desk queues in the ITSM platform; ensure tickets are correctly categorized and assigned per the RACI.
• Route security-relevant events from the NOC or Service Desk to the SOC per the defined escalation pathway with enriched context.
• Route operational recovery actions from the SOC to the NOC or regional IT Operations per the defined protocol.
• Escalate to the Director of Technical Service Operations for any issue that exceeds shift authority.

Compliance Evidence and Documentation:

• Ensure shift activities produce audit-ready evidence supporting PCI DSS v4.0.1 Requirement 10 and Requirement 12.10, and ISO/IEC 27001:2022 A.5.24-A.5.28 and A.8.15-A.8.16.
• Verify handover records, incident timelines, and containment action logs are complete and accurate before shift close.
• Support monthly and quarterly evidence pack preparation.

Continuous Improvement Contribution:

• Identify recurring patterns during the shift (repeat incidents, noisy alerts, gaps in playbook coverage) and log them for review by the NOC, SOC, and Service Desk Managers.
• Participate in post-incident reviews and contribute to the Continual Improvement Register per ITIL 4 Continual Improvement practice.
• Recommend changes to shift-level procedures where the shift experience identifies opportunities.

General Duties and Responsibilities:

• Reliably demonstrate accountability for work assignments and proactive communications about issues and status. A strong history of proactively identifying effective solutions for challenges.
• Able to work effectively and uphold professional standards, with the customer and system stakeholders.
• Self-motivated and able to work unsupervised.
• Methodical and attentive to detail.
• Proactive in seeking advice from senior operations and security subject matter experts when required.
• Comfortable working with staff at all levels and in other geographical locations within the organization.
• Comply with Cubic's Quality Management System.
• Comply with Cubic's quality, health, safety, and security policies.
• Support the company's strategic objectives and collaborate across departments.
• Comply with Cubic Human Resources Procedures.

Skills / Experience / Knowledge:

• Experience providing direct supervision to a team of individual contributors in a technology operations, security operations, or service desk environment.
• Working knowledge of NOC operations: event monitoring, incident management, SLA management, change and configuration control.
• Working knowledge of SOC operations: SIEM and EDR alert triage, security incident classification, escalation protocols.
• Working knowledge of Service Desk operations under a Tier 1-3 tiered model.
• Familiarity with ITIL 4 practices, in particular Monitoring and Event Management and Incident Management.
• Ability to interpret and explain incident status, containment actions, and escalation decisions to peers, subordinate staff, and functional peer groups. Consistent with Cubic Path Matrix M2 Collaboration and Interaction expectations.
• Sound judgment in resolving problems that require analysis of data and relevant factors under real-time pressure. Consistent with Cubic Path Matrix M2 Complexity and Problem Solving expectations.
• Ability to develop and manage routine operational plans and meet targets against a monthly performance plan. Consistent with Cubic Path Matrix M2 Discretion and Impact expectations.
• Experience preparing accurate shift reports and handover records.
• Comfort operating 24x7 shift patterns, including nights, weekends, and public holidays.

Desirable:

• Familiarity with PCI DSS v4.0.1 requirements, in particular Requirement 10, Requirement 11.5, and Requirement 12.10.
• Familiarity with ISO/IEC 27001:2022 Annex A controls covering logging (A.8.15), monitoring activities (A.8.16), and incident management (A.5.24 to A.5.28).
• Exposure to NIST Cybersecurity Framework 2.0 (NIST CSWP 29) Detect and Respond Functions.
• Working knowledge of ServiceNow (or equivalent enterprise ITSM) and Jira.
• Understanding of the ITIL 4 Major Incident model and Problem Management practice.
• Experience coordinating across NOC, SOC, and Service Desk boundaries.

Qualifications:

• Must be able to work on-site on a 24x7 rotating shift pattern.
• Minimum 5-8 years of related experience with a Bachelor's degree.
• University degree in Computer Science, Engineering, Information Systems, or other technical field; or Business Administration with relevant IT work experience.
• At least 5 years of experience in a Tier 1-3 operations environment (NOC, SOC, Service Desk, or NOC/SOC hybrid).
• At least 3 years' experience managing shift workers.
• Demonstrated ability to make severity classification and escalation decisions in a real-time operations setting.
• Demonstrated ability to lead a team through a shift, including workload assignment, coaching, and formal handover.
• At least 3 years' experience working in an ITIL 4 operation.

Desirable:

• ITIL 4 Foundation certification; ITIL 4 Managing Professional or Strategic Leader preferred.
• CompTIA Security+, ISC2 SSCP, or equivalent security operations certification.
• ServiceNow ITSM administrator or user certification.
• Experience in a payment card processing environment, or in a similarly regulated real-time operations environment.
• Experience with global follow-the-sun shift models spanning NAM, EMEA, and APAC time zones.

Condition of Employment:

• Successful outcome of a National Police Check.

The description provided above is not intended to be an exhaustive list of all job duties, responsibilities and requirements. Duties, responsibilities and requirements may change over time and according to business need.

Skills

EDR, ITIL 4, NOC, SIEM, SOC, Service Desk