SOC Team Lead

Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.

Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.

Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.

Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions.

Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.

Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context.

Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.

Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.

Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.

Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.

Support client-facing communications during significant events, maintaining professionalism and clarity under pressure.

Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture.

5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.

Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.

One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.

Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.

Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.

Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.

Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.

Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.

Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop.<span data-c