SOC Lead

Lead and manage a team of SOC L1, L2, and L3 security analysts. Monitor security alerts, events, and incidents using SIEM platforms. Manage incident detection, investigation, escalation, containment, and remediation. Oversee 24/7 SOC operations, shift schedules, and incident escalation processes. Conduct threat hunting and analyze suspicious network activities.

Develop and maintain incident response procedures, playbooks, and SOPs. Ensure timely resolution of security incidents according to defined SLAs. Perform root cause analysis (RCA) for major security incidents. Coordinate with IT, networking, cloud, and infrastructure teams to resolve security threats. Improve detection rules, alert correlation, and SOC monitoring capabilities.

Prepare daily, weekly, and monthly SOC performance reports. Conduct security awareness sessions and mentor junior SOC analysts. Support compliance activities and security audits. Stay updated on emerging cyber threats, vulnerabilities, and attack techniques.

Requirements

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field. 5–8 years of experience in cybersecurity or SOC operations, including team leadership experience. Strong hands-on experience with SIEM tools such as Splunk, IBM QRadar, Microsoft Sentinel, or ArcSight. Knowledge of EDR/XDR solutions such as CrowdStrike, Microsoft Defender, or SentinelOne.

Strong understanding of network security, firewalls, IDS/IPS, VPNs, and endpoint security. Experience in security incident handling, malware analysis, and threat investigation. Familiarity with the MITRE ATT&CK framework and cyber kill chain. Understanding of TCP/IP, DNS, HTTP/HTTPS, and network protocols. Knowledge of vulnerability assessment and management tools such as Nessus, Qualys, or Rapid7.

Experience with threat intelligence platforms and security automation tools. Strong analytical, troubleshooting, communication, and leadership skills.