Role Overview
We are seeking a highly skilled SOC Lead with 8+ years of experience in security operations within an MSSP environment.
This is a hybrid leadership role combining hands‑on technical expertise, SOC operations management, and customer interaction. You will be responsible for leading advanced incident response, driving SOC process improvements, mentoring analysts, and supporting pre-sales activities.
The role requires strong experience across XDR, MDR, and SIEM technologies, with mandatory exposure to either Crowd Strike Falcon/NG SIEM or Taegis platforms.
Key Responsibilities
SOC Operations & Incident Management
- Act as the L2 & L3 escalation point for security alerts, incidents, and investigations.
- Lead end-to-end incident response (triage, containment, eradication, recovery, and RCA).
- Perform deep-dive analysis of complex alerts across XDR, SIEM, and MDR platforms.
- Leverage platforms such as Crowd Strike Falcon, NG SIEM (Log Scale), Taegis, Microsoft Defender XDR, Rapid7, QRadar, Splunk, or similar tools.
SOC Process & Documentation Development
- Develop and enhance SOC SOPs, runbooks, playbooks, and escalation workflows.
- Standardise detection and response processes across different environments and log sources.
- Maintain and expand the SOC knowledge base and operational documentation.
- Ensure compliance with MSSP SLAs, KPIs, and reporting standards.
Threat Hunting & Detection Engineering
- Conduct proactive threat hunting activities using XDR, SIEM, and threat intelligence.
- Develop and optimise detection rules, correlation logic, and analytics use cases.
- Tune alerts to reduce false positives and improve detection accuracy.
Required Qualifications
- 7+ years of cybersecurity experience, with at least 6+ years in SOC operations within an MSSP environment.
- Strong hands-on experience with Crowd Strike Falcon / NG SIEM OR Taegis platform (mandatory).
Preferred Certifications
- Crowd Strike Certifications (CCSE, CCFA, CCFR, CCFH)
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).