Security Operations Center (SOC) Manager

Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer, professional services company, consumer loan originator and servicer, payments processor, renewable energy solutions, and K-12 and higher education expert.For over 40 years, Nelnet has been serving its customers, associates, and communities.

The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team, you're part of a community invested in the success of each individual. That support comes through in our work, as we are united by our mission of creating opportunities for people where they live, learn, and work.

This role fits a hands-on security leader with deep SIEM, detection engineering, and security alerting experience who wants to build a modern, intelligence-driven SOC. You will shape detection strategy, drive automation and SOAR adoption, and partner with Security Engineering, Vulnerability Management, Detection Engineering, Red Team and Risk to protect the confidentiality, integrity, and availability of Nelnet's critical assets. If you thrive on mentoring people, improving mean time to detect and respond (MTTD/MTTR), and making a measurable difference in an organization's security posture, we want to hear from you.

Lead and develop the SOC team

• Lead, coach, and mentor security analysts, incident responders, and threat intelligence specialists.
• Build a collaborative, high-performance, and positive team culture
• Set goals, conduct performance reviews, and identify training and certification needs.
• Manage staffing, shift coverage, and on-call schedules to support monitoring and response.

Run effective SOC operations

• Oversee daily security monitoring, alert triage, detection, and analysis of security events.
• Develop and maintain SOC policies, procedures, playbooks, and workflows.
• Manage and optimize the security toolset, including SIEM, SOAR, EDR, and threat intelligence platforms.
• Drive detection engineering and alert tuning to reduce false positives and close visibility gaps.
• Define, track, and report SOC metrics and KPIs, such as MTTD, MTTR, alert volume, and detection coverage, to security leadership.
• Ensure timely and accurate escalation of incidents in line with Nelnet's incident response plan.

Lead incident response

• Lead and coordinate incident response efforts through containment, eradication, and recovery.
• Develop and maintain the incident response plan, and run regular testing and tabletop exercises.
• Conduct post-incident reviews and turn lessons learned into improvements in tooling, process, and detection.

Lead cyber threat intelligence (CTI)

• Lead the CTI function, setting intelligence requirements and priorities aligned to Nelnet's business risks and threat landscape.
• Produce and share actionable threat intelligence, including threat actor tracking, indicators of compromise (IOCs), and tactics, techniques, and procedures (TTPs).
• Turn intelligence into detections, hunts, and response playbooks, and brief security leadership on emerging threats.
• Participate in industry intelligence-sharing communities and partner with external peers on threat information.

Drive automation and continuous improvement

• Identify and automate repetitive SOC tasks through SOAR playbooks and scripting.
• Apply AI tools such as Codex, Claude, and Gemini to improve SOC processes, alert triage, and investigations, with appropriate human review and data-handling controls.
• Align detections to frameworks such as MITRE ATT&CK.

Collaborate across the business

• Partner with Vulnerability Management, Security Engineering, Detection Engineering, Risk Management, IT, and Compliance teams as-well-as individual business units.
• Work with external partners such as law enforcement, industry peers, and managed security vendors as needed.
• Lead and collaborate on Purple Teaming exercises to improve security posture.

Required qualifications

• Bachelor’s degree in computer science, Information Security, OR a related field, OR equivalent practical experience.
• 3+ years of cybersecurity experience, including 2+ years working in a Security Operations Center (SOC) is a requirement for this role.
• 1+ years of experience leading or managing a team, including team lead or supervisor roles.
• Hands-on expertise with SIEM platforms (such as Splunk, Google SecOps, LogRhythm), including investigation, correlation rules, detection engineering, and alert tuning.
• Working knowledge of SOAR, Firewalls, and EDR platforms (such as CrowdStrike, SentinelOne, or Microsoft Defender).
• Proven experience leading incident response efforts from detection through containment, eradication, recovery, and post-incident review.
• Solid understanding of threat intelligence principles and frameworks, including MITRE ATT&CK.
• Strong analytical, problem-solving, and decision-making skills, with the ability to stay calm under pressure in a fast-paced environment.
• Excellent written and verbal communication skills, with the ability to brief both technical teams and executive leadership.

Preferred qualifications

• Professional certifications such as CCSP, CISM, BTL1, BTL2, CompTIA (Security+,CySA+), GIAC (GSEC, GCIH, GCIA, GCDA)
• Experience with cloud security monitoring in AWS, Azure, or Google Cloud.
• Knowledge of compliance and security frameworks such as NIST CSF, NIST 800-53, ISO 27001, and PCI DSS.
• Experience with scripting or automation in Python or PowerShell.
• Background in financial services or another regulated industry.
• Experience with digital forensics, threat hunting, or purple team exercises.
• Familiarity with AI tools such as Codex, Claude, and Gemini, and how to use them responsibly to improve SOC processes, investigations, and analyst productivity.

Skills and keywords

Security Operations Center (SOC), SOC Manager, SIEM, SOAR, incident response, threat detection, detection engineering, threat hunting, threat intelligence, cyber threat intelligence (CTI), EDR, MITRE ATT&CK, vulnerability management, cloud security, security automation, Purple Teaming, alert triage, tabletop exercises, TTX, MTTD/MTTR, NIST, ISO 27001, PCI DSS, Python, PowerShell, team leadership, generative AI, AI-assisted investigations, cybersecurity.

Annual compensation range for this role is $105,000-$140,000 depending on experience.

This position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates living within 30 miles of an office location to work remotely for part of the week, while also fostering collaboration and team connection through in-office presence three days per week.

Please note that we are unable to provide visa sponsorship for this position. To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship.

Our benefits package includes medical, dental, vision, HSA and FSA, generous earned time off, 401K/student loan repayment, life insurance & AD&D insurance, employee assistance program, employee stock purchase program, tuition reimbursement, performance-based incentive pay, short- and long-term disability, and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc.

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer, we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race, color, religion/creed, national origin, gender, sex, marital status, age, disability, use of a guide dog or service animal, sexual orientation, military/veteran status, or any other status protected by federal, state, or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Talent Acquisition at 402-486-5725 or [email protected].

Nelnet is a Drug Free and Tobacco Free Workplace.

Use of Artificial Intelligence in Hiring

We may use automated or artificial intelligence enabled tools to assist with the initial review of applications, such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information, see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring