Role Description The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA. - Lead Tier I/II/III SOC operations with full escalation authority. - Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation). - Oversee the incident lifecycle from triage through investigation, response, and closure. - Act as incident commander during high-severity events, coordinating stakeholder communication. - Review and approve incident classifications, escalations, and remediation actions. - Conduct daily/weekly operational reviews, tracking incident trends and performance metrics. - Collaborate with engineering teams to improve detection rules and reduce false positives. - Ensure all incidents are documented and audit-ready for compliance assessments. Qualifications - 8-10+ years of experience in SOC operations and incident management. - Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK). - Proven ability to lead cross-functional SOC teams and enforce SLA compliance. - Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics. - Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks. Requirements - Certifications (Preferred / Mandatory): - CISSP (Certified Information Systems Security Professional) - GIAC (GCIH / GCIA / GCFA) - Microsoft Certified: Security Operations Analyst (SC-200) - ITIL / PMP (optional but valuable for governance) Company Description

Role Description The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA. - Lead Tier I/II/III SOC operations with full escalation authority. - Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation). - Oversee the incident lifecycle from triage through investigation, response, and closure. - Act as incident commander during high-severity events, coordinating stakeholder communication. - Review and approve incident classifications, escalations, and remediation actions. - Conduct daily/weekly operational reviews, tracking incident trends and performance metrics. - Collaborate with engineering teams to improve detection rules and reduce false positives. - Ensure all incidents are documented and audit-ready for compliance assessments. Qualifications - 8-10+ years of experience in SOC operations and incident management. - Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK). - Proven ability to lead cross-functional SOC teams and enforce SLA compliance. - Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics. - Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks. Requirements - Certifications (Preferred / Mandatory): - CISSP (Certified Information Systems Security Professional) - GIAC (GCIH / GCIA / GCFA) - Microsoft Certified: Security Operations Analyst (SC-200) - ITIL / PMP (optional but valuable for governance)

Role Description The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA. - Lead Tier I/II/III SOC operations with full escalation authority. - Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation). - Oversee the incident lifecycle from triage through investigation, response, and closure. - Act as incident commander during high-severity events, coordinating stakeholder communication. - Review and approve incident classifications, escalations, and remediation actions. - Conduct daily/weekly operational reviews, tracking incident trends and performance metrics. - Collaborate with engineering teams to improve detection rules and reduce false positives. - Ensure all incidents are documented and audit-ready for compliance assessments. Qualifications - 8-10+ years of experience in SOC operations and incident management. - Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK). - Proven ability to lead cross-functional SOC teams and enforce SLA compliance. - Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics. - Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks. Requirements - Certifications (Preferred / Mandatory): - CISSP (Certified Information Systems Security Professional) - GIAC (GCIH / GCIA / GCFA) - Microsoft Certified: Security Operations Analyst (SC-200) - ITIL / PMP (optional but valuable for governance)

Role Description We are seeking a Cybersecurity Analyst who is available to work out of our Chicago, IL, Cleveland, OH, or Charleston, SC office. The Cybersecurity Analyst will have the exciting opportunity to play a key role in expanding Brookfield Property’s information security program. You will be responsible for working with the security engineering team to: - Remediate threats - Identify opportunities to improve security processes - Hunt for emerging threats - Maintain our industry-leading portfolio of security tools This is a hands-on role; familiarity with Enterprise Security Architectures, Windows systems, Networking, and OT/BMS is critical. Overall, we seek qualities that display our company’s core values which are Humility, Attitude, Do the Right Thing, Together, and Own it. Role & Responsibilities: - Review security incidents to remediate threats and help lead the escalation of security events in conjunction with the incident response plan - Monitor and support security tools to ensure effective detection and response, including assisting with tuning to reduce false positives - Work with our MSSP and other vendors to optimize the escalation processes and reduce false positives - Collaborate with business and technology teams to promote security awareness and support security best practices - Follow established playbooks and operational procedures during incident response, and contribute feedback for continuous improvement - Participate in generating operational improvements through security orchestration and automation tools Qualifications - Bachelor’s degree in Computer Science, Information Security/Cybersecurity, or a related discipline (machine learning, statistics, mathematics, etc.) - At least 1 year of experience in Security or 3 years in IT including Incident Detection, Incident Response, System Administration, or Service Desk - Understanding of fundamental security architecture and networking concepts - Ability to assess and prioritize multiple alerts or incidents based on risk and business impact - Experience participating in major incident response efforts within a fast-paced environment - Able to communicate complex and technical issues to diverse audiences, orally and in writing, in an easily understood and authoritative manner - Knowledge of forensics techniques to determine root cause for security incidents - Documentation and process improvement skills - Experience with Windows, networking, or audit logs, SIEM technologies are a plus - Proven track record of analyzing, diagnosing and solving complex issues - Experience with Cloud technologies including AWS, Azure, and GCP - Security+, CySA+, or equivalent foundational certifications Desired Skills - Previous experience in an environment with extensive OT/IoT presence - Communication skills that translate technical concepts to non-technical stakeholders - Ability to find a balance between Security and Business objectives, by creating a culture where security is a major consideration - Scripting in Python, Bash, or other common languages - Process improvement through automating tasks or scripting Benefits - 401K matching - Tuition reimbursement - Summer Fridays - Paid maternity leave - Generous employee referral program Company Description Brookfield Properties strives to create spaces where going to work never feels routine. We are proud to create a diverse environment and are proud to be an equal opportunity employer. We are grateful for your interest in this position; however, only candidates selected for pre-screening will be contacted.