CYBERSECURITY ENGINEERING MANAGER

Join the State of Florida to lead enterprise SOC engineering that strengthens threat detection and incident response capabilities. This onsite role in Tallahassee, FL combines technical leadership with day-to-day engineering oversight for security tooling, telemetry pipelines, and analytics used by SOC operations. You will help modernize the SOC technology stack while maintaining the reliability and performance of mission-critical platforms.

What you will do

• Lead and supervise the Cybersecurity Engineering team, balancing operational support, project priorities, and modernization initiatives.
• Assign and prioritize workloads, monitor productivity, quality, attendance, deadlines, and professional conduct.
• Set goals, delegate assignments, and build accountability, collaboration, innovation, and continuous improvement.
• Mentor and develop staff through technical guidance, performance feedback, training, and professional development.
• Conduct performance evaluations and address performance or behavioral issues using appropriate corrective and progressive discipline.
• Support organizational and operational change.
• Own strategy and execution for the enterprise SOC technology stack, including SIEM, data lake, SOAR, detection, and threat intelligence platforms.
• Maintain existing security platforms while planning and executing modernization and integration efforts.
• Ensure security tooling and supporting infrastructure are available, reliable, performant, and secure.
• Oversee security telemetry ingestion, retention, and data quality to enable effective detection, analytics, and threat hunting.
• Identify and address gaps in tooling, telemetry, detection coverage, and platform capabilities.
• Direct day-to-day engineering operations supporting SOC detection, response, and analytical activities.
• Oversee configuration, integration, maintenance, and lifecycle management of security technologies in line with enterprise architecture and security standards.
• Lead troubleshooting, root-cause analysis, and remediation for tooling, telemetry, integrations, and platform issues.
• Coordinate engineering support for incident response activities requiring specialized tooling or telemetry expertise.
• Partner with the SOC Manager to align engineering capabilities with analyst requirements, operational workflows, and priorities.
• Coordinate with Enterprise Architecture and cross-functional teams to ensure solutions align with approved architecture standards and modernization initiatives.
• Maintain engineering documentation, including runbooks, procedures, and technical standards.
• Drive continuous improvement in engineering processes, platform reliability, scalability, and operational support.
• Support cybersecurity and SOC maturity efforts through improved platform resilience, automation, integration, and operational effectiveness.
• Other duties as assigned.

Required qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field; equivalent professional experience may be considered in lieu of a degree.
• 6+ years of progressively responsible experience in cybersecurity engineering, security operations engineering, or related technical roles supporting enterprise security platforms.
• 2+ years experience developing or following engineering processes related to change management, configuration management, or operational support.
• 2+ years leading, mentoring, or coordinating technical staff, including task prioritization and workload management.
• Demonstrated experience designing, implementing, configuring, or maintaining security tooling such as SIEM, SOAR, security data platforms, detection systems, or threat intelligence platforms.
• Hands-on experience developing, tuning, and maintaining SIEM detections in a production SOC environment.
• Experience authoring or operationalizing Sigma rules or equivalent structured detection logic.
• Experience selecting, filtering, or optimizing security telemetry to support detection and investigation outcomes.
• Experience collaborating with cross-functional teams to support incident response, platform integration, or modernization initiatives.
• Strong written and verbal communication skills.
• Relevant professional certifications (such as CISSP, CCSP, cloud security certifications, or equivalent) preferred.

Technologies

• SIEM
• data lake
• SOAR
• Sigma rules

Additional job-related requirements

• Criminal background investigation including fingerprinting and statewide and national criminal history records check per Section 110.1127 Florida Statutes, Chapter 435 Florida Statutes, and the Federal Bureau of Investigation’s CJIS Security Policy CJISD-ITS-DOC-08140-4.5
• Ability to sit for extended periods of time.
• Ability to stand for extended periods of time.
• Ability to drive and/or fly long distances.
• Ability to lift, push and pull up to 30 lbs.

Compensation: USD 100,000 - 125,000 per year.

Location: Tallahassee, FL (onsite), 32399.

Special notes

• DMS is committed to successfully recruiting and onboarding talented and skilled individuals into its workforce.
• Veterans and individuals with disabilities are encouraged to contact a recruiter for guidance and answers through [email protected] and [email protected].
• Reasonable accommodations: Candidates requiring accommodations under the Americans with Disabilities Act must contact DMS Human Resources at (850) 488-2707, or notify the agency hiring authority and/or People First Service Center (1-866-663-4735), in advance to allow sufficient time to provide the accommodation.
• The State of Florida supports a Drug-Free workplace. All employees are subject to reasonable suspicion drug testing in accordance with Section 112.0455, F.S., Drug-Free Workplace Act.