About the role
Job Title: SOC Technical Lead/Manager
Job Summary
We are looking for a highly experienced and hands-on SOC Technical Lead/Manager with 12–15 years of cybersecurity experience to drive advanced security operations, lead complex incident response, and enhance detection and response maturity across the SOC.
This role goes beyond traditional L3 responsibilities, requiring deep technical expertise, leadership ownership, and strategic influence across SOC operations, detection engineering, automation, and customer engagement. The ideal candidate will act as a technical authority and mentor, while actively contributing to investigations, threat hunting, and SOC transformation initiatives, including AI/ML-driven detection and XDR adoption.
Key Responsibilities
1. Advanced Incident Response & Security Operations
Lead end-to-end incident response lifecycle (detection to recovery) aligned with NIST framework.
Handle high-severity and complex cyber incidents, including APTs, ransomware, and insider threats.
Perform deep-dive investigations, malware analysis, digital forensics, and root cause analysis.
Act as the final escalation point for L2/L3 analysts and ensure SLA adherence (MTTD, MTTR).
Drive post-incident reviews and implement preventive controls.
2. SOC Leadership & Governance
Provide technical leadership and mentorship to SOC analysts (L1/L2/L3).
Own SOC operations governance, including KPIs, SLAs, reporting, and compliance.
Manage client/stakeholder engagement, including executive-level communication.
Lead war rooms, incident bridges, and customer escalations.
Ensure SOC alignment with frameworks such as MITRE ATT&CK and NIST CSF.
3. Detection Engineering & SIEM/XDR Operations
Architect and optimize detection use cases across SIEM and XDR platforms.
Hands-on with tools such as:
SIEM: LogRhythm, Securonix, Microsoft Sentinel, Splunk, Palo Alto XSIAM
XDR/EDR: CrowdStrike, Microsoft Defender, Palo Alto Cortex
Design and fine-tune correlation rules, UEBA models, and anomaly detection.
Improve detection coverage mapped to MITRE ATT&CK techniques (TTPs).
Drive false positive reduction and quality improvement.
4. Threat Hunting & Threat Intelligence
Lead proactive threat hunting programs using SIEM, EDR, and cloud telemetry.
Integrate and operationalize threat intelligence feeds.
Identify emerging threats, including deep/dark web risks and attack surface exposures (ASM).
Detect and respond to advanced adversaries and targeted attacks.
5. SOAR Automation & SOC Transformation
Design and implement SOAR playbooks (Splunk SOAR, Palo Alto XSOAR, Securonix SOAR).
Automate repetitive SOC tasks to improve efficiency and response time.
Drive adoption of AI/ML-based SOC capabilities for anomaly detection and triage.
Collaborate with engineering teams to enhance tool integrations and orchestration.
6. Endpoint, Cloud & Data Security
Perform advanced investigations using EDR tools (CrowdStrike, MDE).
Lead cloud security monitoring and incident response (AWS, Azure, GCP).
Investigate DLP and insider threat incidents.
Provide guidance on security architecture, hardening, and data protection.
7. Continuous Improvement & Metrics
Track and optimize SOC metrics: MTTD, MTTR, dwell time, false positives.
Drive process improvements, runbooks, and SOP standardization.
Support audits, compliance, and SOC maturity assessments.
Contribute to innovation initiatives in SOC (AI/ML, automation, threat modeling).
Required Skills & Qualifications
Bachelor’s degree in Computer Science, Cybersecurity, or related field.
12–15 years of experience in SOC, Incident Response, Threat Detection, or Cyber Defense.
Strong hands-on expertise in:
SIEM / SOAR / EDR / XDR platforms
Detection engineering and use case development
Threat hunting and threat intelligence
Deep understanding of:
MITRE ATT&CK framework
NIST Cybersecurity Framework & Incident Response lifecycle
Experience in:
SOC governance and operations management
Client handling and stakeholder communication
Malware analysis and digital forensics
Strong knowledge of:
Network protocols, log analysis, and attack techniques
Cloud security (AWS/Azure/GCP)
Key Competencies
Strong hands-on technical depth + leadership mindset
Excellent analytical and problem-solving skills
Effective communication with technical and business stakeholders
Ability to drive SOC transformation and innovation
Proven experience in team leadership and customer engagement