Cybersecurity Operations Manager

Lyra Technology Group is a p rivate e quity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group , we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.    The Cybersecurity Operations Manager is the senior technical leader and final escalation point for security events across Scarlett's managed clients. This is a hands-on leadership role: the Manager leads day-to-day delivery of managed security services while remaining directly involved in detection, investigation, and incident response. The position sits between security strategy, owned by the vCISO, and execution, carried out by the SOC team. The Manager is accountable for the security posture and incident outcomes our clients experience, with a role that is outcome-driven, focused on reducing client risk, improving response times, and being the dependable last line of decision-making when a security event escalates. About Scarlett Group.... Scarlett Group is recognized as a JBJ Best Places to Work and is one of the fastest-growing technology companies in the region. We offer competitive benefits, opportunities for advancement, professional development support, and a culture built on collaboration, accountability, and having fun while doing meaningful work. Great benefits. Great people. Great opportunities. That's the Scarlett difference. Your work as a Cybersecurity Operations Manager will include several components: Security Leadership and Escalation Serve as the final escalation point for security alerts and incidents across all managed clients. Lead and develop the Cybersecurity Operations team with direct, hands-on coaching and clear accountability. Establish roles, expectations, KPIs, and escalation paths for the SOC team. Own queue health across all managed clients, including alert volume, aging, assignment, and first-line escalation; delegate day-to-day queue work to SOC team members while retaining accountability for the outcome. Work the security queue directly when volume exceeds team capacity or when SOC team members are on PTO, out, or otherwise unavailable – queue coverage is an expected part of this working leadership role, not an exception. SOC and Incident Response Oversee daily SOC operations, including monitoring, alert triage, and response. Lead containment, eradication, and recovery during security incidents, and own post-incident root cause analysis and documentation; engage Advanced Services for deep forensic analysis when an incident requires it. Improve detection logic, alert quality, and response workflows on an ongoing basis. Manage MDR and SIEM partner relationships and…