SOC Team Lead

Summary of Essential Job Functions

• Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model. 

• Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability. 

• Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification. 

• Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions. 

• Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership. 

• Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context. 

• Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development. 

• Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment. 

• Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement. 

• Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise. 

• Support client-facing communications during significant events, maintaining professionalism and clarity under pressure. 

• Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture. 

Experience and Certifications

• 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience. 

• Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred. 

• One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications. 

• Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies. 

Technical Background Requirements

• Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management. 

• Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework. 

• Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case. 

• Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise. 

• Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop.