Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer, professional services company, consumer loan originator and servicer, payments processor, renewable energy solutions, and K-12 and higher education expert. For over 40 years, Nelnet has been serving its customers, associates, and communities.
The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team, you're part of a community invested in the success of each individual. That support comes through in our work, as we are united by our mission of creating opportunities for people where they live, learn, and work.
Nelnet is hiring a Security Operations Center (SOC) Manager to lead the team that detects and investigates cyber threats across a regulated financial services environment that protects the data of millions of customers. You will lead security monitoring, incident response, and threat detection, and you will lead a team of security analysts, incident responders, and threat intelligence specialists.
This role fits a hands-on security leader with deep SIEM, detection engineering, and security alerting experience who wants to build a modern, intelligence-driven SOC. You will shape detection strategy, drive automation and SOAR adoption, and partner with Security Engineering, Vulnerability Management, Detection Engineering, Red Team and Risk to protect the confidentiality, integrity, and availability of Nelnet's critical assets. If you thrive on mentoring people, improving mean time to detect and respond (MTTD/MTTR), and making a measurable difference in an organization's security posture, we want to hear from you. Lead and develop the SOC team
Lead, coach, and mentor security analysts, incident responders, and threat intelligence specialists.
Build a collaborative, high-performance, and positive team culture
Set goals, conduct performance reviews, and identify training and certification needs.
Manage staffing, shift coverage, and on-call schedules to support monitoring and response.
Run effective SOC operations
Oversee daily security monitoring, alert triage, detection, and analysis of security events.
Develop and maintain SOC policies, procedures, playbooks, and workflows.
Manage and optimize the security toolset, including SIEM, SOAR, EDR, and threat intelligence platforms.
Drive detection engineering and alert tuning to reduce false positives and close visibility gaps.
Define, track, and report SOC metrics and KPIs, such as MTTD, MTTR, alert volume, and detection coverage, to security leadership.
Ensure timely and accurate escalation of incidents in line with Nelnet's incident response plan.
Lead incident response
Lead and coordinate incident response efforts through containment, eradication, and recovery.
Develop and maintain the incident response plan, and run regular testing and tabletop exercises.
Conduct post-incident reviews and turn lessons learned into improvements in tooling, process, and detection.
Lead cyber threat intelligence (CTI)
Lead the CTI function, setting intelligence requirements and priorities aligned to Nelnet's business risks and threat landscape.
Produce and share actionable threat intelligence, including threat actor tracking, indicators of compromise (IOCs), and tactics, techniques, and procedures (TTPs).
Turn intelligence into detections, hunts, and response playbooks, and brief security leadership on emerging threats.
Participate in industry intelligence-sharing communities and partner with external peers on threat information.
Drive automation and continuous improvement
Identify and automate repetitive SOC tasks through SOAR playbooks and scripting.
Apply AI tools such as Codex, Claude, and Gemini to improve SOC processes, alert triage, and investigations, with appropriate human review and data-handling controls.
Align detections to frameworks such as MITRE ATT&CK.
Collaborate across the business
Partner with Vulnerability…