SOC (Security Operations Center) Lead

Job Summary:

The SOC Lead is responsible for leading day-to-day Security Operations Center activities, managing incident response, mentoring SOC analysts, and ensuring effective monitoring, detection, and response to cybersecurity threats. This role bridges technical execution and operational leadership, ensuring continuous security monitoring and rapid incident containment.

Must Have Skills:

Strong knowledge of:

• SIEM platforms: Splunk, QRadar, Sentinel, ArcSight, etc.
• EDR/XDR tools: CrowdStrike, Defender, Carbon Black, etc.
• Network security: firewalls, IDS/IPS, VPNs
• Cloud security: AWS, Azure, GCP
• Incident response lifecycle and digital forensics basics
• MITRE ATT CK framework

Good To Have Skills:

• Wazuh
• Kibana

Key Responsibilities:

• Leadership Management
  • Lead and manage the SOC team, including L1, L2, and L3 analysts.
  • Oversee daily SOC operations and ensure SLA compliance.
  • Provide mentorship and training to junior analysts.
• Incident Response Threat Management
  • Supervise and guide the resolution of complex security incidents.
  • Develop and implement incident response playbooks and escalation processes.
  • Conduct advanced threat hunting and forensic investigations.
• Security Strategy Governance
  • Define and enforce SOC policies, procedures, and best practices.
  • Ensure compliance with regulatory and organizational security standards.
  • Collaborate with IT, Risk, and Compliance teams to align security initiatives.
• Monitoring Reporting
  • Monitor SIEM alerts and manage escalation workflows.
  • Produce SOC performance metrics and reports for senior leadership.
  • Continuously improve detection and response capabilities.
• SOC Operations Incident Management
• Team Leadership Mentoring
• Threat Detection Improvement
• Proactive approach to Security Strategy Governance

Qualifications / Candidate Requirements (If Applicable):

• Bachelor s degree in computer science, Information Security, or related field.

Certifications (Preferred but not Mandatory):

• CISSP, CISM, or equivalent preferred