• Help monitor Stantec’s systems for signs of intrusion • Work closely with the IT Security team to investigate, contain, and remediate security incidents • Perform operational reviews of IT security systems and monitor key consoles • Participate in the investigation of alleged security breaches to help determine root cause, impact, remediation • Respond to incidents reported by users through Stantec's IT ticketing systems • Assist IT Security administrators in management and operational configuration of IT Security systems and controls • Document all security incidents and near misses reported in our incident response system • Other duties as assigned

• Apply expert knowledge of concepts, processes, practices, and procedures on technical assignments • Support enterprise Cybersecurity standards • In coordination with Government develop and implement Cybersecurity standards and procedures • Coordinate, develop, and recommend security processes for an organization • Recommend Cybersecurity solutions to support customers’ requirements • Identify and report security violations • Recommend and satisfy Cybersecurity requirements based upon the analysis of CSPP, policy, regulatory, and resource demands • Support customers at the highest levels in the development and implementation of processes and policies • Apply know-how to government and commercial common user systems, as well as to dedicated special purpose systems requiring specialized security features and procedures • Support design and development of security features for system architecture requirements • Analyze and make recommendations of security requirements for computer systems which may include mainframes, workstations, and personal computers • Support design, development, engineering, and implementation of solutions that meet CSPP requirements • Provide integration and implementation of the computer system security solution • Analyze general Cybersecurity-related technical problems and provide basic engineering and technical support in solving these problems • Support vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle • Perform all procedures necessary to ensure the safety of information systems data assets and to protect systems from intentional or inadvertent access, theft, or destruction • Ensure that all information systems are functional and secure • Provide subject matter expertise, direction, guidance, tracking, and support on cyber security, risk management, continuous monitoring, security Assessment and Authorization (A&A), and business processes that support a metric-driven environment • Develop, maintain, and update Plans of Action and Milestones (POA&M) to identify system weaknesses, mitigation, and timelines for applying corrective actions

Role Description The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA. - Lead Tier I/II/III SOC operations with full escalation authority. - Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation). - Oversee the incident lifecycle from triage through investigation, response, and closure. - Act as incident commander during high-severity events, coordinating stakeholder communication. - Review and approve incident classifications, escalations, and remediation actions. - Conduct daily/weekly operational reviews, tracking incident trends and performance metrics. - Collaborate with engineering teams to improve detection rules and reduce false positives. - Ensure all incidents are documented and audit-ready for compliance assessments. Qualifications - 8-10+ years of experience in SOC operations and incident management. - Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK). - Proven ability to lead cross-functional SOC teams and enforce SLA compliance. - Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics. - Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks. Requirements - Certifications (Preferred / Mandatory): - CISSP (Certified Information Systems Security Professional) - GIAC (GCIH / GCIA / GCFA) - Microsoft Certified: Security Operations Analyst (SC-200) - ITIL / PMP (optional but valuable for governance) Company Description

Role Description The SOC Lead / Incident Manager will oversee 24x7x365 Security Operations Center (SOC) functions for the Congressional Budget Office vSOC program. This role requires strong leadership in incident response, SLA enforcement, and team management, with hands-on expertise in Microsoft Sentinel and Defender environments. The SOC Lead will serve as the escalation authority, ensuring operational excellence, audit readiness, and compliance with federal frameworks such as NIST SP 800-53 and FISMA. - Lead Tier I/II/III SOC operations with full escalation authority. - Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation). - Oversee the incident lifecycle from triage through investigation, response, and closure. - Act as incident commander during high-severity events, coordinating stakeholder communication. - Review and approve incident classifications, escalations, and remediation actions. - Conduct daily/weekly operational reviews, tracking incident trends and performance metrics. - Collaborate with engineering teams to improve detection rules and reduce false positives. - Ensure all incidents are documented and audit-ready for compliance assessments. Qualifications - 8-10+ years of experience in SOC operations and incident management. - Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK). - Proven ability to lead cross-functional SOC teams and enforce SLA compliance. - Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics. - Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks. Requirements - Certifications (Preferred / Mandatory): - CISSP (Certified Information Systems Security Professional) - GIAC (GCIH / GCIA / GCFA) - Microsoft Certified: Security Operations Analyst (SC-200) - ITIL / PMP (optional but valuable for governance)