Security Operations Lead

POSITION:
Security Operations Lead

LOCATION:

Hybrid (This person can be based out of our Dallas/Frisco, TX or Conshohocken, PA Corporate Headquarters) DEPARTMENT:
Technology

REPORTS TO:

VP, Cyber Security LEGENDS GLOBAL

Legends Global is the premier partner to the world’s greatest live events, venues, and brands. We deliver a fully integrated suite of premium services through a white-label model that keeps our partners front and center — from feasibility and project development to sales, partnerships, hospitality, merchandise, venue management, and world‑class content and booking. With a global network of more than 450 venues, hosting 20,000 events and welcoming 165 million guests annually, Legends Global brings unmatched scale, expertise, and connectivity to help our partners grow.

The Legends Global Way guides how we operate:
Align, Scale, Connect, Team, Win — shared success, repeatable systems, connected solutions, unstoppable teams, and wins that are earned every day.

The Security Operations Lead is responsible for detection, triage, and response operations across our enterprise. This role blends hands‑on incident handling with detection engineering, playbook development, and response automation efforts. This role delivers on alerts and case management, drives resilient detection strategies, and leads hunt efforts that proactively surface threats before they become incidents. Joining a team of SOC Analysts, the Security Operations Lead sets the standard on how to identify, triage, and resolve cybersecurity incidents, and demonstrates this to the SOC team.

This role is a great opportunity for a seasoned analyst to lead by example on how a global Security Operations Center should run.

• Independently lead complex or high‑impact security incidents and identify opportunities to improve SOC processes, tools, and response capabilities.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and establishing standards for documentation, communication, and delivery. Build and operationalize SOC playbooks and escalation workflows.
• Lead alert triage, enrichment, prioritization, and false‑positive suppression.
• Author detection requirements and write and tune SIEM rules.
• Develop threat‑hunting hypotheses and lead hunt efforts using advanced telemetry and threat intelligence.
• Design detection strategies across the kill chain and help advance the enterprise detection strategy.
• Execute complex incidents end‑to‑end, including containment, eradication, documentation, and communication.
• Conduct post‑incident reviews and drive remediation and control improvements.
• Promote industry collaboration and embed resilient detection engineering practices.
• Advocate for and implement automation‑first incident response.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and setting standards for documentation, communication, and delivery.

• Proven experience in a SOC or equivalent detection and response function, with a focus on high‑fidelity detections, repeatable playbooks, and measurable outcomes.
• Three to five years of experience in Security Operations, Detection and Response, or Incident Handling; SOC experience is required.
• Hands‑on experience with SIEM platforms, such as Google Security Operations, Microsoft Sentinel, or IBM QRadar; EDR platforms, such as Crowd Strike, Microsoft Defender, or Sentinel One; and SOAR platforms.
• Proficiency in authoring detections, tuning rules, developing enrichment pipelines, and improving alert routing.
• Demonstrated experience building and executing incident‑response playbooks and containment and eradication plans.
• Experience conducting post‑incident reviews and…