SOC Lead

About the role

We're looking for a SOC Lead who is the senior authority for all SOC shifts. This role is responsible for directing the shift teams, managing alert queues, making escalation decisions, and ensuring all open incidents are properly tracked, documented, and handed off.

Responsibilities

• Provide Tier 4 escalation and resolution for the most complex incidents and outages
• Direct the daily operations of the shift team across the SOC
• Monitor alert queues and ensure Tier 1-3 analysts are triaging within SLA standards
• Make escalation decisions such as activating T3/IR, on-call engineers, and management chain as appropriate
• Manage the shift handoff process, ensuring a turnover briefing is produced and delivered at each handoff window
• Mentor, manage and train the SOC staff
• Review and approve all Priority 2 and above incident tickets before escalation
• Develop and modify playbooks
• Ensure all playbooks are being followed correctly and appropriately updated
• Maintain situational awareness across all incoming alerts, calls, network monitoring, and active triage
• Coordinate with NOC staff on network issues that may have a security component
• Review and verify all shift logs and all required reporting

Requirements

• 10+ years of SOC or similar experience
• At least 3+ years in a senior or lead role
• Bachelor's degree in Cyber Security, Information Technology, Computer Science, Information Security, or related field
• One of the following certifications, equivalent or better: CISSP, CISM, or CISA, or GCIH
• One of the following certifications, equivalent or better: Sec+, CYSA+, SecX, CEH, GCIA, GSOC
• Expert proficiency with hands-on incident response experience including containment, eradication, and recovery
• Advanced experience with SIEM platforms and log analysis
• Advanced experience SIEM query languages (SPL, KQL, or equivalent)
• Advanced experience PCAP analysis tools (Wireshark, NetworkMiner, or equivalent)
• Advanced experience with EDR, endpoint forensics, memory analysis, and network forensics tools
• Deep understanding of attacker TTPs, kill chain methodology, and MITRE ATT&CK
• Ability to work shifts including nights, weekends, and holidays on rotating shift schedule
• Demonstrated experience managing and mentoring junior analysts
• Ability to remain calm and direct operations during high-pressure incidents

Preferred Qualifications

• GCFA or GCFE certification or other forensic certifications
• Active Secret clearance preferred but not required
• Experience with threat hunting frameworks and platforms
• Reverse engineering experience (IDA Pro, Ghidra)
• Prior experience on a DFIR team or incident response retainer
• Experience with malware analysis (static and dynamic)
• Experience with zero-trust network architecture
• Experience with classified network environments (SIPRNet, NIPRNet)
• Direct experience as SOC experience SOAR platform experience

Benefits

• Salary: $170k- $220k
• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• Certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms