SOC Team Leader – Security Operations and Incident Response

We are looking for an experienced SOC leader to direct our Security Operations Center (SOC) and supervise all security surveillance, incident response, and team management activities. The ideal candidate has more than 10 years of experience in SOC and incident response, including several years as a manager or supervisor. He/she combines solid technical skills with assertive leadership, coaching, and team development abilities. You will be responsible for daily SOC operations, continuous improvement of detection and response capabilities, and developing a high-performing analyst team.

Key responsibilities:

Leadership and SOC Management

• Lead, manage, and supervise a team of SOC analysts (levels 1-3) and incident responders
• Coordinate activities between internal and external teams and partners
• Manage SOC personnel, scheduling, and on-call duties to ensure 24/7 coverage or defined coverage
• Define clear expectations, objectives, and development plans for team members
• Conduct regular individual interviews and performance evaluations.
• Create a positive and responsible culture focused on learning, collaboration, and continuous improvement.

Operations and Incident Management

• Supervise daily SOC operations, including alert triage, investigation quality, and incident management.
• Ensure the coordination of incident response or escalation for critical incidents.
• Guarantee the rapid and consistent execution of incident response processes (containment, eradication, recovery, lessons learned).
• Closely collaborate with IT, infrastructure, application, and business teams during security incidents.
• Participate in the on-call system as a escalation point

Process, Governance, and Continuous Improvement

• Maintain and evolve SOC operation manuals, playbooks, and standard operating procedures.
• Define and track key performance indicators (KPIs) and metrics for the SOC (MTTD, MTTR, incident volume, false positives, etc.) and report to management.
• Improve alert quality, automation, and workflows to reduce noise and increase efficiency.
• Contribute to the global incident response program, including simulation exercises and post-incident analysis.

Technology and Detection

• Supervise the effective use of SIEM, EDR/XDR, SOAR, and other security tools within the SOC.
• Closely collaborate with detection engineers and security architects to develop and optimize use cases, correlation rules, and analyses.
• Evaluate new tools and features that can strengthen surveillance, threat detection, and incident response.

Stakeholder Management and Communication

• Ensure primary liaison with internal stakeholders and management during security incidents.
• Provide clear and concise updates on incidents, as well as post-incident reports tailored to technical and non-technical audiences.
• Closely collaborate with risk management, compliance, and audit teams to demonstrate SOC effectiveness and facilitate evaluations.