SOC Engineer

Lyra Technology Group is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of Evergreen Services Group, we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.  

Lead SOC Engineer – ImageQuest

ImageQuest is looking for an experienced Lead SOC Engineer to serve as the technical backbone of our Security Operations Center. This is a senior technical role focused primarily on escalations and incident response, security tooling ownership, proactive threat hunting, and scripting and automation within a managed services environment. The Lead SOC Engineer is the SOC's primary escalation point, owning confirmed compromises from containment through handoff to the Advisory Services team. The ideal candidate is comfortable building deep, custom policy on the tools our analysts and clients depend on, hunting for threats that automated tooling misses, and reducing manual SOC workload over time.

About ImageQuest….

ImageQuest is a Nashville, Tennessee-based managed IT and managed security services provider serving regulated businesses across the United States, including banking, healthcare, insurance, legal, non-profit, and wealth management organizations. Founded in 2007, the company delivers managed IT, cybersecurity, incident response, virtual CISO leadership, compliance consulting, and cloud support, all with a proactive, compliance-focused approach. ImageQuest is part of Lyra Technology Group.

Your work as a Lead SOC Engineer will include several components:

Escalation & Incident Response

• Own all escalations and confirmed compromises referred from the SOC Analysts.
• Investigate and triage escalated alerts to determine severity, scope, and whether a compromise is confirmed.
• Contain and resolve security incidents before they affect client business operations.
• Manage internal communication during suspected and confirmed incidents, and work directly with clients to explain the containment and investigation process under time constraints.
• Serve as backup to the SOC Analysts in responding to inbound alerts as needed.
• Conduct post-incident debriefs with the Cybersecurity Advisory team.

Threat Hunting & Security Monitoring