Overview Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visitperaton.comto learn how we’re keeping people around the world safe and secure. Responsibilities Peraton requires aSOC 1 Operations Leadto support the Special Operation Command Information Technology Enterprise Contract (SITEC) - 3 EOM.  This position is located at MacDill AFB in Florida.The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365.TheSOC Tier 1 Operations Leadserves as the senior technical and operational lead on the operations floor, driving real-time alert triage, incident escalation quality, and continuous Cyber Detection Health Monitoring across 24/7 enterprise shifts. Acting as the first escalation point for frontline analysts, the Lead is responsible for maintaining high-tempo queue management, enforcing strict Service Level Agreements (SLAs), and ensuring analytical rigor across all initial investigations. In addition to guiding triage operations, the Lead takes direct technical ownership of detection health-monitoring SIEM scheduler queues, tracking log ingestion latencies, validating forwarder uptime, and ensuring automated alerting pipelines function without disruption. This position combines hands-on technical analysis, shift leadership, and operational health management to safeguard enterprise assets against adversary activity.Duties:Lead daily shift operations, actively directing and participating in the triage of incoming security events from SIEM, EDR, IDS/IPS, and email security gateways to ensure rapid Mean Time to Acknowledge (MTTA) and Mean Time to Triage (MTTT).Track real-time log ingestion feeds, forwarder status (e.g., Splunk Universal Forwarders, Syslog collectors), and sensor availability; rapidly flag and troubleshoot data drop-offs, parsing errors, or telemetry delays with engineering teams.Serve as the immediate technical escalation point for SOC 1 analysts on complex or high-priority events; perform real-time quality assurance (QA) on triage notes, scoping decisions, and escalation packages before routing to SOC 2 / Incident Response teams.Author, update, and refine Tier 1 triage runbooks, investigation guides, and standard operating procedures (SOPs) to ensure consistent, repeatable alert handling across all shifts.Identify noisy, poorly tuned, or redundant detection rules generating high false-positive rates; document analytical findings and submit structured tuning recommendations to Detection Engineering.Provide continuous operational leadership, mentorship, and technical support to frontline Tier 1 analysts across all shifts in a 24/7/365 schedule. Conduct structured shift turnovers, deliver real-time investigative guidance during high-tempo alert cycles, and lead technical upskilling initiatives to ensure consistent analytical rigor, operational continuity, and high team morale across day, swing, and mid shifts. Qualifications Required Qualifications:Minimum 10 years of experienceDoD 8570 IAT II CertificationDoW TS/SCI clearanceMust be DoW 8140 compliant under the Work Role Code 531- Cyber Defense Incident Responder - Intermediate level or higherDesired Qualifications:Strong analytical and problem-solving skillsAbility to communicate security issues clearly to both technical and non-technical stakeholdersStrong understanding of security technologies used to defend Enterprise networks such as EDR, XDR, IDS, IPS, SIEM and SOAR.Hands-on experience using SIEM solutions such as Splunk and Microsoft Sentinel.Experience working on a SOC with 24/7 mission.