SecOps Command Center Lead

Job Type: Contract,Permanent

Work Mode: Hybrid (3 Days from office)

Sec Ops Command Center (L1)

24x7 Security Monitoring, Alert Triage, Escalation & Shift Leadership

Lead and manage the L1 Sec Ops Command Center. Ensure consistent security monitoring, triage and escalation across shifts, while supervising the on-floor analyst team.

• Supervise the Sec Ops Command Center analysts across shifts, including rosters and shift handover.
• Own the shift schedule and make sure 24x7 security monitoring coverage has no gaps.
• Coach analysts on triage quality, tool use and SOP adherence.
• Review shift performance: alert volume, response times and missed alerts.
• Stakeholder Management, collaboration with different teams and attend the MIM meetings in case of P1/P2 incidents
• Be the point of escalation when an analyst cannot resolve or classify a security alert.

• Oversee continuous monitoring of security alerts across endpoint, network, DLP and identity tools. Analyze the alerts to reduce duplicate alerts/noise suppression and optimize the alerts.
• Confirm alerts are triaged, enriched and routed to the correct Application/MIM/Infra/L2 security tower within the target time if not resolved on the SOPs/Runbooks.
• Check service and endpoint availability monitoring, including agent health and coverage.
• Confirm Service Now tickets are raised, updated and closed with clear notes/logs.
• Escalate confirmed security incidents to the client's security team promptly, with evidence and recommended action.

• Produce and review the daily and weekly Sec Ops Command Center status report for leadership.
• Assist MIM to Run RCA and post-incident reviews for major or repeated security incidents.
• Keep SOPs, escalation matrices and knowledge-base articles current.
• Track and report on SLA and KPI performance for the Command Center.

• Keep Service Now tickets and dashboards current, with clear resolution and closure notes.
• Work with DLP, Malware Tools, Network Security and IDAM leads on process and tooling changes.

• SIEM or security monitoring platform (Splunk)
• Endpoint (Jamf) and network security consoles (read access)
• Dashboarding and reporting tools
• Shift roster and workforce management tools

• Windows Bit Locker for Laptop and basic knowledge of Network Security, IDAM, Malware & DLP
• Endpoint and service availability monitoring
• ITSM incident, problem and change processes
• Shift and workforce management
• SLA and KPI reporting
• RCA and continuous improvement

• 10+ Years of experience in a 24x7 Security Operations Center environment
• Experience leading or supervising a shift-based security monitoring team
• Knowledge of cybersecurity fundamentals.
• Security alert triage and escalation across endpoint, network and identity tools
• SLA/KPI reporting and RCA facilitation
• Clear written and spoken English, including leadership reporting

• GIAC Security Essentials (GSEC) or equivalent SOC certification