SOC Lead

Job Description

Lead SOC operations with a focus on Microsoft security stack, including Microsoft Sentinel, Defender suite, and email security platforms. Responsible for incident response, threat detection, and continuous improvement of monitoring capabilities. 

Roles & Responsibilities

• Manage end-to-end SOC operations including monitoring, triage, escalation, and closure
  

• Lead incident response lifecycle (detection, analysis, containment, eradication, recovery)
  

• Administer andoptimizeMicrosoft Sentinel(analytics rules, workbooks, connectors)
  

• Perform advanced threat hunting usingMicrosoft Defender (Endpoint, O365, Identity, Cloud Apps)
  

• Investigate and respond to alerts fromDefender XDR and Sentinel incidents
  

• Manage and tune alerting to reduce false positives and improve detection accuracy
  

• Develop, test, and maintainSIEM use cases and correlation rules
  

• Build andmaintainSOAR playbooks using Logic Apps / automation rules
  

• Monitor and respond to email security incidents (Defender for O365)
  

• Investigate identity-based threats and risky sign-ins inEntra ID (Azure AD)
  

• Integrate log sources across cloud, endpoint, identity, and network platforms
  

• Perform root cause analysis and document incident findings
  

• Coordinate with IT, cloud, and application teams for remediation and closure
  

• Track and report SOC metrics (MTTD, MTTR, incident trends, etc.)
  

• Ensure compliance alignment with ISO 27001 / SOC 2 controls
  

• Mentor SOC analysts and guide L1/L2 teams on investigations
  

• Drive continuous improvement in detection coverage and SOC maturity
  

• Stay updated with latest threats, vulnerabilities, and attack techniques
  

Required Skills
SOC Operations & Monitoring 
Microsoft Sentinel (SIEM) 
Microsoft Defender Suite (Endpoint, O365, Identity) 
Proofpoint / Email Security 
Incident Response & Threat Hunting 
Entra ID (Azure AD) Security Monitoring