Security Operations Center (SOC) Manager

Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer professional services company consumer loan originator and servicer payments processor renewable energy solutions and K-12 and higher education expert. For over 40 years Nelnet has been serving its customers associates and communities.

The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team youre part of a community invested in the success of each individual. That support comes through in our work as we are united by our mission of creating opportunities for people where they live learn and work.

Nelnet is hiring a Security Operations Center (SOC) Manager to lead the team that detects and investigates cyber threats across a regulated financial services environment that protects the data of millions of customers. You will lead security monitoring incident response and threat detection and you will lead a team of security analysts incident responders and threat intelligence specialists.

This role fits a hands-on security leader with deep SIEM detection engineering and security alerting experience who wants to build a modern intelligence-driven SOC. You will shape detection strategy drive automation and SOAR adoption and partner with Security Engineering Vulnerability Management Detection Engineering Red Team and Risk to protect the confidentiality integrity and availability of Nelnets critical assets. If you thrive on mentoring people improving mean time to detect and respond (MTTD/MTTR) and making a measurable difference in an organizations security posture we want to hear from you.

Lead and develop the SOC team

• Lead coach and mentor security analysts incident responders and threat intelligence specialists.
• Build a collaborative high-performance and positive team culture
• Set goals conduct performance reviews and identify training and certification needs.
• Manage staffing shift coverage and on-call schedules to support monitoring and response.

Run effective SOC operations

• Oversee daily security monitoring alert triage detection and analysis of security events.
• Develop and maintain SOC policies procedures playbooks and workflows.
• Manage and optimize the security toolset including SIEM SOAR EDR and threat intelligence platforms.
• Drive detection engineering and alert tuning to reduce false positives and close visibility gaps.
• Define track and report SOC metrics and KPIs such as MTTD MTTR alert volume and detection coverage to security leadership.
• Ensure timely and accurate escalation of incidents in line with Nelnets incident response plan.

Lead incident response

• Lead and coordinate incident response efforts through containment eradication and recovery.
• Develop and maintain the incident response plan and run regular testing and tabletop exercises.
• Conduct post-incident reviews and turn lessons learned into improvements in tooling process and detection.

Lead cyber threat intelligence (CTI)

• Lead the CTI function setting intelligence requirements and priorities aligned to Nelnets business risks and threat landscape.
• Produce and share actionable threat intelligence including threat actor tracking indicators of compromise (IOCs) and tactics techniques and procedures (TTPs).
• Turn intelligence into detections hunts and response playbooks and brief security leadership on emerging threats.
• Participate in industry intelligence-sharing communities and partner with external peers on threat information.

Drive automation and continuous improvement

• Identify and automate repetitive SOC tasks through SOAR playbooks and scripting.
• Apply AI tools such as Codex Claude and Gemini to improve SOC processes alert triage and investigations with appropriate human review and data-handling controls.
• Align detections to frameworks such as MITRE ATT&CK.

Collaborate across the business

• Partner with Vulnerability Management Security Engineering Detection Engineering Risk Management IT and Compliance teams as-well-as individual business units.
• Work with external partners such as law enforcement industry peers and managed security vendors as needed.
• Lead and collaborate on Purple Teaming exercises to improve security posture.

Required qualifications

• Bachelors degree in computer science Information Security OR a related field OR equivalent practical experience.
• 3 years of cybersecurity experience including 2 years working in a Security Operations Center (SOC) is a requirement for this role.
• 1 years of experience leading or managing a team including team lead or supervisor roles.
• Hands-on expertise with SIEM platforms (such as Splunk Google SecOps LogRhythm) including investigation correlation rules detection engineering and alert tuning.
• Working knowledge of SOAR Firewalls and EDR platforms (such as CrowdStrike SentinelOne or Microsoft Defender).
• Proven experience leading incident response efforts from detection through containment eradication recovery and post-incident review.
• Solid understanding of threat intelligence principles and frameworks including MITRE ATT&CK.
• Strong analytical problem-solving and decision-making skills with the ability to stay calm under pressure in a fast-paced environment.
• Excellent written and verbal communication skills with the ability to brief both technical teams and executive leadership.

Preferred qualifications

• Professional certifications such as CCSP CISM BTL1 BTL2 CompTIA (SecurityCySA) GIAC (GSEC GCIH GCIA GCDA)
• Experience with cloud security monitoring in AWS Azure or Google Cloud.
• Knowledge of compliance and security frameworks such as NIST CSF NIST 800-53 ISO 27001 and PCI DSS.
• Experience with scripting or automation in Python or PowerShell.
• Background in financial services or another regulated industry.
• Experience with digital forensics threat hunting or purple team exercises.
• Familiarity with AI tools such as Codex Claude and Gemini and how to use them responsibly to improve SOC processes investigations and analyst productivity.

Skills and keywords

Security Operations Center (SOC) SOC Manager SIEM SOAR incident response threat detection detection engineering threat hunting threat intelligence cyber threat intelligence (CTI) EDR MITRE ATT&CK vulnerability management cloud security security automation Purple Teaming alert triage tabletop exercises TTX MTTD/MTTR NIST ISO 27001 PCI DSS Python PowerShell team leadership generative AI AI-assisted investigations cybersecurity.

Annual compensation range for this role is $105000-$140000 depending on experience.

This position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates living within 30 miles of an office location to work remotely for part of the week while also fostering collaboration and team connection through in-office presence three days per week.

Please note that we are unable to provide visa sponsorship for this position. To be considered candidates must already be authorized to work in the United States without the need for current or future sponsorship.

Our benefits package includes medical dental vision HSA and FSA generous earned time off 401K/student loan repayment life insurance & AD&D insurance employee assistance program employee stock purchase program tuition reimbursement performance-based incentive pay short- and long-term disability and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc.

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race color religion/creed national origin gender sex marital status age disability use of a guide dog or service animal sexual orientation military/veteran status or any other status protected by federal state or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Talent Acquisition at

Nelnet is a Drug Free and Tobacco Free Workplace.

Use of Artificial Intelligence in Hiring

We may use automated or artificial intelligence enabled tools to assist with the initial review of applications such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring