SOC Team Lead

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of SOC operations during your designated shift, ensuring round-the-clock monitoring and seamless, accountable transitions within the follow-the-sun model.

• Oversee the alert and case queue, manage analyst workloads, prioritize high-severity incidents, and guarantee that cases progress with urgency and accountability.

• Act as the primary quality-assurance checkpoint during the shift by evaluating cases for accuracy, completeness, and defensibility prior to escalation or client notification.

• Serve as the first escalation point for analysts, providing technical direction on complex investigations and making or supporting decisions regarding incident declarations.

• Coordinate incident response efforts during active incidents, facilitating communication, task assignments, and status updates to clients and SOC leadership.

• Supervise the human-in-the-loop component above agentic triage and suppression, ensuring AI-driven outcomes are validated, fine-tuned, and enriched with relevant client context.

• Coach, mentor, and develop Tier 1 and Tier 2 analysts.

• Monitor and propel shift performance concerning MTTD, MTTR, MTTC, false-positive rates, and SLA achievements.

• Ensure compliance with SOPs, runbooks, playbooks, and quality standards, while contributing to ongoing improvements.

• Collaborate with detection engineering and Tier 2 to pinpoint tuning and suppression opportunities, thereby minimizing recurring noise.

• Assist in client-facing communications during critical events.

• Escalate personnel, process, and platform issues to the SOC Manager.

⛳️ Requirements

• 5–8 years of experience in security operations or incident response, with proven Tier 2 / senior analyst experience.

• Previous experience as a shift lead, team lead, or in a mentorship/quality-review role is highly preferred.

• One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.

• Practical experience with SIEM, EDR / XDR, SOAR, and other relevant security technologies.

• Extensive hands-on knowledge of SOC operations, detection and response workflows, and incident management.

• Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.

• Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.

• Familiarity with detection tuning, alert suppression, and detection-as-code concepts.

• Understanding of AI-assisted and agentic security operations, including the governance and guardrails necessary for ensuring safety, auditability, and human oversight.

• Knowledge of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.

• Strong leadership presence with the ability to guide, coach, and inspire analysts in a fast-paced 24x7 environment.

• Exceptional decision-making and judgment skills, particularly under pressure and during active incidents.

• Excellent verbal and written communication skills, including client-facing communication during critical events.

• Ability to maintain and enforce quality standards while fostering team development and morale.

• Strong organizational and prioritization skills to effectively manage queue, coverage, and workload simultaneously.

• Willingness to work a shift-based schedule, including nights, weekends, or holidays, and be part of an on-call rotation as necessary.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.

🏝️ Benefits

• Medical, Dental, and Vision Insurance.

• 401(k).

• Paid company holidays.

• Paid time off.

• Paid parental and caregiver leave.

• Multi-million-dollar technology lab.

• Cross-department training and development.

• Sponsored certifications and credentials for ongoing learning.

• Option to opt-out of AI application and resume review without penalty.

• Option to opt-out of interview recording and transcription without penalty.