Lead SOC Analyst

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.

Dragonfli is hiring a Senior Lead SOC Analyst to anchor our overnight security operations team. In this role, you will drive advanced investigation, incident response, and proactive threat hunting across client tenants, perform quality control on Tier 1 and Tier 2 work, and mentor analysts on shift. You will own the most complex escalations, serve as the primary overnight point of contact for clients and leadership, and drive continuous improvement of runbooks and detection tuning. This position is well suited to candidates with 6+ years of SOC experience, including incident response leadership and mentoring.

This is a contract position involving a large commercial enterprise in the transportation/logistics (critical infrastructure) sector. Candidates with previous consulting or contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.

Responsibilities:

• Lead advanced investigation and incident response for escalated events across client tenants
• Conduct proactive threat hunting
• Perform quality control review of Tier 1 and Tier 2 triage, investigation, and documentation
• Mentor and provide real-time guidance to Tier 1 and Tier 2 analysts on shift
• Own the most complex containment, response, and escalation decisions
• Serve as the primary point of contact for clients and on-call leadership during overnight events
• Drive continuous improvement of standard operating procedures, runbooks, and detection tuning
• Support monthly reporting with accurate event and response data and trend analysis

Must-Have:

• United States citizenship
• Ability to pass a drug screening and a full background investigation, including verification of references, employment history, education, and certifications
• 6+ years of SOC or security operations experience, including incident response and mentoring or leadership
• Demonstrated threat hunting and advanced investigation experience
• Strong command of SIEM and EDR platforms and vulnerability management workflows
• Understanding of the incident lifecycle: detection, triage, containment, and escalation
• Ability to work overnight shifts reliably on a rotation that includes weekends
• Excellent written communication and documentation discipline

Preferred / Nice-to-Have:

• Expert-level experience with Microsoft Sentinel, Splunk, CrowdStrike or comparable EDR, and Tenable
• GCIH, GSEC, GCFA, CySA+, or a similar advanced certification
• Scripting or automation experience (Python or PowerShell)
• Prior managed security services or multi-tenant SOC leadership experience
• Exposure to critical-infrastructure environments
• Residency in the Hampton Roads, Virginia area

Technical Skills:

• Advanced incident response
• Threat hunting
• SOC quality control
• SIEM and EDR platform mastery
• Detection engineering and tuning
• Mentorship and training design

Soft Skills:

• Leadership under pressure
• Mentoring and coaching
• Executive-level communication
• Sound judgment on escalation decisions
• Ownership of shift outcomes

Medical – Multiple POS health plan options including an HSA-compatible plan

Dental – PPO coverage for preventive, basic, and major services

Vision – Annual exam, frames, lenses, and contact lens allowance

401(k) – Employer match up to 5% of eligible compensation

Long-Term Disability – 100% employer-paid coverage at 50% of pre-disability earnings

Life Insurance & AD&D – 100% employer-paid coverage valued at $10,000 each

PTO – 15–25 days annually based on tenure

Paid Federal Holidays – All 11 federal holidays observed