SOC Lead

Overview

The Lead is the senior technical authority across security monitoring incident response (IR) andplatform engineering and leads a combined team on a day-to-day basis. Reporting to theOperations Manager the Lead sets technical direction uplifts the maturity of operations andacts as the final escalation point for complex investigations. Three groups report into this role:IR responders SOC L1/L2 analysts and Platform Engineering (PE) / SIEM engineers.

The role demands both a hands-on investigator who can independently drive incidents to rootcause and remediation and a leader who can coordinate IR direct a shift and steer theplatform engineering function that onboards clients answers their coverage questions andbuilds the detections their environments require.

Key Responsibilities

Incident Response & Coordination

• Lead and coordinate high-severity incidents (P1/P2) end-to-end running bridge calls anddirecting the IR responders through detection containment eradication and recovery
• Serve as the senior escalation and decision point for complex investigations providingtechnical validation and clear direction under pressure
• Investigate hands-on to find solutions deep-dive analysis of endpoint network andidentity telemetry malware behaviour and adversary TTPs to establish root cause andremediation not just triage
• Guide forensic examination (endpoints servers logs memory network traffic) to supportinvestigative outcomes and attribution
• Maintain IR SOPs forensic playbooks and escalation workflows feeding lessons learnedback into detections and process
• Lead technical coordination for cyber drills and tabletop exercises translating outcomesinto concrete improvements

Platform Engineering (PE) & Detection

• Lead the PE / SIEM engineering function directing onboarding of new clients log sourcesand assets onto the monitoring platform and ensuring healthy complete data ingestion
• Act as the senior technical contact for client queries advising on asset coverageanswering questions about their monitored estate and translating their needs intomonitoring outcomes
• Own the detection lifecycle design build test and tune SIEM use cases and correlationrules including new detections requested by clients or driven by their specific markets andthreat landscape
• Build and mature automation across monitoring IR and platform engineering orchestration and SOAR playbooks that cut manual effort and accelerate response
• Continuously evaluate best-in-market approaches and tooling (SIEM SOAR EDR/XDRthreat intel AI-assisted triage) and drive adoption where they add clear value
• Operationalize threat intelligence into detections and run threat hunting / hypothesis-driveninvestigations to close coverage gaps

Team Leadership

• Lead the combined team IR responders SOC L1/L2 analysts and PE / SIEM engineers allocating work managing shift coverage and ensuring the team consistently follows theright process
• Uplift the team and set direction mentor and coach across IR monitoring and platformengineering raise technical standards and build a clear path for capability improvement
• Provide quality assurance over the teams output (triage accuracy escalation qualityonboarding detection changes documentation) and hold the team accountable to SLAsand standards
• Act as the day-to-day technical face of the team to the Operations Manager surfacingrisks gaps and improvement opportunities

Key Performance Indicators (KPIs)

• Incident handling: number of incidents contained/resolved within SLA; MTTD and MTTR trendimprovements particularly for P1/P2
• Detection quality: number of use cases tuned with measurable falsepositive reduction;increase in high-fidelity true-positive alerts
• Onboarding & platform delivery: client/asset onboarding delivered on schedule; newclient detection requests actioned within agreed timelines; monitoring coveragecompleteness
• Automation & maturity: number of automated/SOAR workflows implemented; number ofincidents leveraging automation; number of playbooks reviewed and validated on cadence
• Team performance: adherence to process/SLA; QA scores across IR SOC and PE;measurable uplift in team capability and feedback on guidance

Person Specifications

Qualifications & Experience

• 8 years hands-on experience across security monitoring incident response and digitalforensics including senior/escalation responsibility
• Demonstrable experience leading P1/P2 incidents and coordinating multiple teams underpressure
• Experience leading or supervising a SOC / IR / engineering team including shift coverage
• Experience in SIEM platform engineering client/log-source onboarding and buildingdetections to meet client requirements
• Degree/Diploma in Information Technology Cybersecurity or a related discipline
• Certifications preferred: GCIH GCFA GREM CHFI. Good to have: GCIA GCDAGMON Microsoft SC-200 AZ-500 SC-100 CISSP

Knowledge & Technical Skills

Required Skills

• Deep hands-on SIEM capability building tuning and maintaining use cases correlation rules and dashboards; strong grounding in detection engineering as a discipline
• Proven platform engineering experience onboarding log sources/assets data ingestion and coverage and building detections tailored to client environments
• Proven automation/SOAR experience designing and implementing orchestration and playbooks to improve SOC and IR efficiency
• Strong operational IR and digital forensics capability including malware analysis and threat hunting
• Solid knowledge of APTs adversary tools/techniques and MITRE ATT&CK TTPs
• Strong networking / TCP-IP knowledge and exposure to firewall IPS EPP/EDR DLP proxy and email security controls
• Ability to review and integrate PT / vulnerability findings into monitoring and IR workflows
• Cloud security monitoring across Azure AWS and GCP
• Excellent written/verbal communication with the ability to work with clients and lead under pressure during major incidents

Desired Skills

• Microsoft security stack (strong plus aligned to our current environment):Microsoft Sentinel (SIEM/SOAR) Microsoft Defender XDR KQL Logic Apps automationand Security Copilot
• Experience with other market-leading platforms (e.g. Splunk QRadar) and EDR solutions(CrowdStrike Carbon Black)
• Scripting/programming for automation (e.g. PowerShell Python KQL)
• Threat intelligence platform experience and the ability to operationalize intel feeds
• Familiarity with regulatory/compliance-driven incident handling (e.g. NIST ISO 27035 PDPA/GDPR)