---
title: 'Lead SOC Engineer at Lyra Technology Group'
canonical: 'https://feeny.ai/job/lead-soc-engineer-lyra-technology-group-brentwood-3xbzyv2rn6z2'
type: 'job'
last_seen: '2026-10-17'
---

# Lead SOC Engineer at Lyra Technology Group

- **Company:** Lyra Technology Group
- **Location:** Brentwood, TN
- **Posted:** 2026-09-30
- **Last confirmed live:** 2026-10-17
- **Apply:** https://job-boards.greenhouse.io/lyratechgroup/jobs/5439603008

## Job description

[Lyra Technology Group](http://www.lyratechgroup.com/) is a private equity-backed holding company that invests in and operates industry leading technology service businesses. Our companies are operated independently by exceptional management teams. Companies that join our group retain the employees, name, and culture that have made them successful. As a platform of [Evergreen Services Group](http://www.evergreensg.com/), we never divest from businesses we partner with and approach every decision with the goal of driving sustainable and healthy growth over the long term.

Lead SOC Engineer – ImageQuest

ImageQuest is looking for an experienced Lead SOC Engineer to serve as the technical backbone of our Security Operations Center. This is a senior technical role focused primarily on escalations and incident response, security tooling ownership, proactive threat hunting, and scripting and automation within a managed services environment. The Lead SOC Engineer is the SOC's primary escalation point, owning confirmed compromises from containment through handoff to the Advisory Services team. The ideal candidate is comfortable building deep, custom policy on the tools our analysts and clients depend on, hunting for threats that automated tooling misses, and reducing manual SOC workload over time.

About ImageQuest….

ImageQuest is a Nashville, Tennessee-based managed IT and managed security services provider serving regulated businesses across the United States, including banking, healthcare, insurance, legal, non-profit, and wealth management organizations. Founded in 2007, the company delivers managed IT, cybersecurity, incident response, virtual CISO leadership, compliance consulting, and cloud support, all with a proactive, compliance-focused approach. ImageQuest is part of Lyra Technology Group.

Your work as a Lead SOC Engineer will include several components:

Escalation & Incident Response

- Own all escalations and confirmed compromises referred from the SOC Analysts.
- Investigate and triage escalated alerts to determine severity, scope, and whether a compromise is confirmed.
- Contain and resolve security incidents before they affect client business operations.
- Manage internal communication during suspected and confirmed incidents, and work directly with clients to explain the containment and investigation process under time constraints.
- Serve as backup to the SOC Analysts in responding to inbound alerts as needed.
- Conduct post-incident debriefs with the Cybersecurity Advisory team.

Threat Hunting & Security Monitoring

- Conduct proactive threat hunting across the client base rather than relying solely on inbound alerts.
- Continually monitor security intelligence and threat chatter that may affect ImageQuest clients.
- Maintain a current understanding of the threat landscape relevant to ImageQuest's client industries.

Spam Filter & Phishing Escalation

- Serve as the escalation point for Defender for Office, IronScales, and Mimecast configuration and tuning.
- Own escalated phishing investigations referred from the SOC Analysts, determining scope and whether further containment is needed.
- Adjust spam filter policy, including sender and domain blocks, allow lists, and quarantine rules, in response to confirmed phishing campaigns.
- Coordinate directly with clients on high-impact phishing incidents requiring same-day action.

Endpoint & Tooling Ownership

- Configure and maintain Microsoft Defender for Endpoint, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf across the client base.
- Build deeper, custom ThreatLocker policy beyond the standard baseline maintained by the SOC Analysts, precise enough to block real threats without breaking legitimate client applications.
- Investigate tooling gaps and false positives, tuning detection rules to reduce noise reaching the Analyst queue.

Automation & Process Improvement

- Drive scripting and automation improvements across the SOC's alert and ticketing tools to reduce manual, repetitive work.
- Establish and maintain accurate documentation of SOC processes and incident responses.
- Pull monthly reports and categorize SOC activity appropriately.

Client Onboarding & Advisory Support

- Support onboarding of new clients, including deployment of security tooling and validation of SOC coverage.
- Provide technical expertise to Advisory Services during incidents, audits, and cyber insurance claims that require deep technical detail.
- Participate in cyber incident response tabletop exercises as needed.

Documentation & Communication

- Ensure all client-facing documentation is consistent with ImageQuest format and professional standards.
- Communicate technical incident details clearly to both technical and non-technical clients and internal stakeholders.
- Collaborate with the Managed IT team, including the Network Operations Center, Field Technicians, and Service Desk.
- Participate in occasional on-site client visits and off-site ImageQuest client events.

Our ideal Lead SOC Engineer has the following qualifications:

- 3+ years of proven IT security experience, with hands-on incident response or threat hunting experience.
- Bachelor's degree in computer science, information technology, or a related field desired.
- Deep working knowledge of SentinelOne, ThreatLocker, Huntress, and Arctic Wolf, or comparable EDR, application control, SIEM, and MDR platforms.
- Demonstrated ability to investigate, triage, and contain confirmed security incidents.
- Working knowledge of a scripting language (e.g., PowerShell) for automation and tooling improvements.
- Thorough understanding of networks (IP subnetting, TCP/IP, routing, VPN) and common attack vectors.
- Familiarity with common industry pentesting tools and methodology.
- Familiarity with regulatory frameworks and guidance, including NIST, CIS Controls, and ISO 27002.
- Strong analytical and problem-solving skills, with the ability to cut through noise to find the root cause and exercise sound judgment under pressure.
- Precise and detail-oriented when configuring tools that affect client production environments.
- Ability to function well in a high-paced, interrupt-driven environment and balance proactive work against active escalations.
- Strong written and verbal communication skills, with the ability to break down complex technical information for non-technical audiences.
- Proficiency with Microsoft Office (Excel, Word, PowerPoint, Outlook) and Microsoft Teams.
- Nice to have: familiarity with virtualization technologies and the Microsoft Azure Portal, experience in a managed services or consulting environment, and familiarity with SIEM platforms and vulnerability scanners.
- Recommended certifications: CompTIA Security+, Network+, or CySA+, and Microsoft SC-200 or SC-300.

This role is based in Brentwood, TN and will operate on a hybrid basis, with a base compensation range of $90,000-$95,000.

We are seeking a candidate who goes beyond alert triage. The ideal candidate will be comfortable owning incidents end-to-end, making sound decisions with incomplete information, and taking full responsibility for the quality and accuracy of the security tooling our clients depend on. This includes the ability to receive an escalation, quickly distinguish a confirmed compromise from noise, contain the threat, communicate clearly with the client, document the response thoroughly, and hand it off successfully to Advisory Services. If you are an analytical, detail-oriented security professional who enjoys bringing order out of disorder in a managed services environment, we would welcome the opportunity to speak with you.

## About Lyra Technology Group

## Company Overview
- **One-liner**: A permanent holding company that acquires and operates a family of industry-leading IT managed services businesses, retaining each company’s brand, employees, and culture while providing the scale of a global platform.
- **Entity Type**: Private (backed by Evergreen Services Group)
- **Headquarters**: Chicago, Illinois, United States
- **Founded**: 2017 (first acquisition in 2018; Lyra Technology Group launched in 2021)
- **Founders**: Not publicly available; the platform was created by Evergreen Services Group and launched under the leadership of CEO Elliott Hyman

## Core Business
- **Primary industry**: IT Services & IT Consulting (Managed Services, Cybersecurity, Cloud Solutions)
- **Target customers**: Small and medium-sized organizations (SMBs) across various verticals
- **Mission / purpose**: “Grow Your Legacy” – Providing a permanent home for technology service businesses so they can thrive without the pressure of a future exit.

## Products & Services
Lyra Technology Group does not sell a single product; it owns and operates over 100 independently managed IT service companies around the world. Each company delivers its own portfolio, including:
- **Managed IT Services** (helpdesk, network monitoring, on-site support)
- **Cybersecurity** (managed security, compliance, incident response)
- **Cloud & Infrastructure** (migration, Microsoft/AWS/Azure management)
- **AI Process Consulting** (emerging focus – multiple AI Consultant roles posted)
- **IT Project Management** (for enterprise deployments)
- **Hardware & Field Services** (procurement, deployment, break-fix)

## Market Standing
- **Valuation / Market Cap**: Not disclosed (privately held)
- **Key metric**: Annual Revenue estimated between $100M and $500M (per LinkedIn data)
- **Notable Investors / Partners**: Evergreen Services Group (sole platform backer), with a network of 110+ acquired founders
- **Growth Signals**:
  - Over 4,000 team members serving 12,000+ clients and managing 276,000+ devices
  - 22.1% employee headcount growth year-over-year
  - Active M&A: recent acquisitions include Blackbird IT, DKBInnovative (2024), REDD Digital Services (2025), and Optimising IT
  - 34 active job postings (up 36% monthly and 42% yearly)
  - Launching an AI transformation initiative led by Chief Transformation Officer Marlena Slowik

## Competitive Advantages
- **Permanent ownership** – Evergreen Services Group never divests, ensuring long-term stability for acquired companies and their teams.
- **Preservation of identity** – Acquired companies keep their name, leadership, and culture, which drives high employee retention and NPS scores.
- **Scale without bureaucracy** – Each business operates independently, but benefits from shared talent, knowledge, and purchasing power across the Lyra family.
- **Founder-friendly model** – More than 110 founders have chosen to join, signaling strong trust in the partnership approach.

## Strategic Focus
- **AI transformation**: Embedding AI into service delivery and internal operations (dedicated AI process consultants and forward deployment engineers).
- **Geographic expansion**: Operating across the US, UK, Canada, Australia, and New Zealand, with continued regional CEO hires to deepen local presence.
- **Service expansion**: Adding cybersecurity, cloud, and project management capabilities to meet growing SMB demand.
- **Talent development**: Investing in internal career paths, with roles spanning from helpdesk to senior leadership.

## Why Work Here
- **Culture & values**: High employee ratings (4.8/5 overall on LinkedIn, with Culture scored 4.7/5). Core values include Gratitude, Persistence, Growth Mindset, and Integrity.
- **Career opportunities**: Active hiring across 34 positions in engineering, AI, project management, finance, and sales – with clear promotion paths within a rapidly growing group.
- **Work environment**: Mix of remote, hybrid, and on-site roles depending on the company. Many positions offer flexibility; some require local presence for field support.
- **Perks & stability**: Part of a permanent platform (no risk of flip), plus access to a community of industry-leading peers. Benefits include competitive compensation (Compensation rating 4.5/5) and a focus on work-life balance (4.0/5).
- **Engineering & innovation**: Growing AI and cybersecurity teams, with opportunities to work on cutting-edge projects in a stable, founder-oriented organization.

## Sources
1. [lyratechgroup.com](https://lyratechgroup.com/)  
2. [lyratechgroup.com/careers](https://lyratechgroup.com/careers/)  
3. [lyratechgroup.com/our-team](https://lyratechgroup.com/our-team/)  
4. [linkedin.com/company/lyra-technology-group-evergreen](https://www.linkedin.com/company/lyra-technology-group-evergreen)  
5. [job-boards.greenhouse.io/lyratechgroup](http://job-boards.greenhouse.io/lyratechgroup)

## Other roles at Lyra Technology Group

- [Senior Systems Engineer](https://feeny.ai/job/senior-systems-engineer-lyra-technology-group-san-francisco-8vzzarm2e44n) — San Francisco, CA
- [Associate, Portfolio Operations & Value Creation](https://feeny.ai/job/associate-portfolio-operations-value-creation-lyra-technology-group-chicago-82ghzgf59yqf) — Chicago, IL
- [Technical Support Engineer (L2)](https://feeny.ai/job/technical-support-engineer-l2-lyra-technology-group-new-york-dcne9r3866rh) — New York, NY
- [VP of Operations - North](https://feeny.ai/job/vp-of-operations-north-lyra-technology-group-vancouver-bc-or-chicago-gcdp48pwv9k6) — Vancouver Bc OR Chicago, IL
- [Operating Executive](https://feeny.ai/job/operating-executive-lyra-technology-group-philadelphia-e3g99c52q36v) — Philadelphia, PA
- [Senior Accountant](https://feeny.ai/job/senior-accountant-lyra-technology-group-chicago-8ndya17b7gn8) — Chicago, IL
- [Cybersecurity Operations Manager](https://feeny.ai/job/cybersecurity-operations-manager-lyra-technology-group-jacksonville-nmm66wr9sgh8) — Jacksonville, FL
- [Client Success Manager](https://feeny.ai/job/client-success-manager-lyra-technology-group-holmdel-x05chr6jv3z1) — Holmdel, NJ
- [Director of Client Success](https://feeny.ai/job/director-of-client-success-lyra-technology-group-holmdel-vz6jxbpvcm2e) — Holmdel, NJ
- [Associate](https://feeny.ai/job/associate-lyra-technology-group-chicago-xe7y6xg0fjp1) — Chicago, IL