{"id":1526628,"url":"https://alion.io/job/lyra-soc-engineer","title":"Lead SOC Engineer","company":{"id":678790,"name":"LYRA","domain":"lyratechgroup.com","url":"https://alion.io/company/lyratechgroup","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Hardware","role_family":"Hardware","seniority":"lead","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":90000,"max":95000,"currency":"USD","period":"year","gross":null,"usd_annual":95000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Office","optional":false},{"name":"Microsoft Teams","optional":false},{"name":"Outlook","optional":false},{"name":"PowerShell","optional":false},{"name":"SentinelOne","optional":false},{"name":"Service Desk","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"VPN","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-09-30T12:47:51Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-31T18:50:38Z","board_verified":true,"closed_at":null,"days_open":31,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":31},"description":"Lyra Technology Group is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group, we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.\nLead SOC Engineer - ImageQuest\nImageQuest is looking for an experienced Lead SOC Engineer to serve as the technical backbone of our Security Operations Center. This is a senior technical role focused primarily on escalations and incident response, security tooling ownership, proactive threat hunting, and scripting and automation within a managed services environment. The Lead SOC Engineer is the SOC's primary escalation point, owning confirmed compromises from containment through handoff to the Advisory Services team. The ideal candidate is comfortable building deep, custom policy on the tools our analysts and clients depend on, hunting for threats that automated tooling misses, and reducing manual SOC workload over time.\nAbout ImageQuest….\nImageQuest is a Nashville, Tennessee-based managed IT and managed security services provider serving regulated businesses across the United States, including banking, healthcare, insurance, legal, non-profit, and wealth management organizations. Founded in 2007, the company delivers managed IT, cybersecurity, incident response, virtual CISO leadership, compliance consulting, and cloud support, all with a proactive, compliance-focused approach. ImageQuest is part of Lyra Technology Group.\nYour work as a Lead SOC Engineer will include several components:\nEscalation & Incident Response\nOwn all escalations and confirmed compromises referred from the SOC Analysts.\nInvestigate and triage escalated alerts to determine severity, scope, and whether a compromise is confirmed.\nContain and resolve security incidents before they affect client business operations.\nManage internal communication during suspected and confirmed incidents, and work directly with clients to explain the containment and investigation process under time constraints.\nServe as backup to the SOC Analysts in responding to inbound alerts as needed.\nConduct post-incident debriefs with the Cybersecurity Advisory team.\nThreat Hunting & Security Monitoring\nConduct proactive threat hunting across the client base rather than relying solely on inbound alerts.\nContinually monitor security intelligence and threat chatter that may affect ImageQuest clients.\nMaintain a current understanding of the threat landscape relevant to ImageQuest's client industries.\nSpam Filter & Phishing Escalation\nServe as the escalation point for Defender for Office, IronScales, and Mimecast configuration and tuning.\nOwn escalated phishing investigations referred from the SOC Analysts, determining scope and whether further containment is needed.\nAdjust spam filter policy, including sender and domain blocks, allow lists, and quarantine rules, in response to confirmed phishing campaigns.\nCoordinate directly with clients on high-impact phishing incidents requiring same-day action.\nEndpoint & Tooling Ownership\nConfigure and maintain Microsoft Defender for Endpoint, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf across the client base.\nBuild deeper, custom ThreatLocker policy beyond the standard baseline maintained by the SOC Analysts, precise enough to block real threats without breaking legitimate client applications.\nInvestigate tooling gaps and false positives, tuning detection rules to reduce noise reaching the Analyst queue.\nAutomation & Process Improvement\nDrive scripting and automation improvements across the SOC's alert and ticketing tools to reduce manual, repetitive work.\nEstablish and maintain accurate documentation of SOC processes and incident responses.\nPull monthly reports and categorize SOC activity appropriately.\nClient Onboarding & Advisory Support\nSupport onboarding of new clients, including deployment of security tooling and validation of SOC coverage.\nProvide technical expertise to Advisory Services during incidents, audits, and cyber insurance claims that require deep technical detail.\nParticipate in cyber incident response tabletop exercises as needed.\nDocumentation & Communication\nEnsure all client-facing documentation is consistent with ImageQuest format and professional standards.\nCommunicate technical incident details clearly to both technical and non-technical clients and internal stakeholders.\nCollaborate with the Managed IT team, including the Network Operations Center, Field Technicians, and Service Desk.\nParticipate in occasional on-site client visits and off-site ImageQuest client events.\nOur ideal Lead SOC Engineer has the following qualifications:\n3+ years of proven IT security experience, with hands-on incident response or threat hunting experience.\nBachelor's degree in computer science, information technology, or a related field desired.\nDeep working knowledge of SentinelOne, ThreatLocker, Huntress, and Arctic Wolf, or comparable EDR, application control, SIEM, and MDR platforms.\nDemonstrated ability to investigate, triage, and contain confirmed security incidents.\nWorking knowledge of a scripting language (e.g., PowerShell) for automation and tooling improvements.\nThorough understanding of networks (IP subnetting, TCP/IP, routing, VPN) and common attack vectors.\nFamiliarity with common industry pentesting tools and methodology.\nFamiliarity with regulatory frameworks and guidance, including NIST, CIS Controls, and ISO 27002.\nStrong analytical and problem-solving skills, with the ability to cut through noise to find the root cause and exercise sound judgment under pressure.\nPrecise and detail-oriented when configuring tools that affect client production environments.\nAbility to function well in a high-paced, interrupt-driven environment and balance proactive work against active escalations.\nStrong written and verbal communication skills, with the ability to break down complex technical information for non-technical audiences.\nProficiency with Microsoft Office (Excel, Word, PowerPoint, Outlook) and Microsoft Teams.\nNice to have: familiarity with virtualization technologies and the Microsoft Azure Portal, experience in a managed services or consulting environment, and familiarity with SIEM platforms and vulnerability scanners.\nRecommended certifications: CompTIA Security+, Network+, or CySA+, and Microsoft SC-200 or SC-300.\nThis role is based in Brentwood, TN and will operate on a hybrid basis, with a base compensation range of $90,000-$95,000. \nWe are seeking a candidate who goes beyond alert triage. The ideal candidate will be comfortable owning incidents end-to-end, making sound decisions with incomplete information, and taking full responsibility for the quality and accuracy of the security tooling our clients depend on. This includes the ability to receive an escalation, quickly distinguish a confirmed compromise from noise, contain the threat, communicate clearly with the client, document the response thoroughly, and hand it off successfully to Advisory Services. If you are an analytical, detail-oriented security professional who enjoys bringing order out of disorder in a managed services environment, we would welcome the opportunity to speak with you.","description_format":"text","description_chars":7497,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Managed IT Services (MSP)"],"lifecycle":[{"event":"open","at":"2026-09-30T14:22:36Z"}],"visa":[],"liveness":{"score":78,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.87,"p_room":0.9,"age_days":30,"expected_fill_days":46,"reasons":["conf:1","velocity","win:mid"],"computed_at":"2026-10-31T05:58:55Z"},"pay":{"stated_usd_annual":95000,"is_top_pay":false},"html_url":"https://alion.io/job/lyra-soc-engineer","json_url":"https://alion.io/job/lyra-soc-engineer.json","meta":{"generated_at":"2026-10-31T20:21:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31973,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678790},"rest":"https://alion.io/mcp/rest/get_company?id=678790"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flyra-soc-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flyra-soc-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flyra-soc-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lyra-soc-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flyra-soc-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1526628}},{"tool":"search_jobs","arguments":{"company":"lyratechgroup.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1526628},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}