Cyber Security Lead Architect

The Cyber Security Lead Architect – SOC & Incident Response is the senior technical authority responsible for architecting, governing, and continuously improving security detection, response, and incident handling capabilities within a Managed Security Services Provider (MSSP) environment. This role bridges security architecture and frontline SOC execution, ensuring tools, detections, workflows, and response processes are designed for scale, speed, and consistency across multiple clients.

The Lead Architect serves as the highest escalation point for complex incidents and ensures SOC operations remain defensible, repeatable, and mature.

• Define SOC architecture standards across SIEM, SOAR, EDR, XDR, and vulnerability platforms
• Architect SOC workflows supporting 24x7 monitoring, triage, and escalation
• Partner with SOC leadership to reduce alert noise and increase analyst effectiveness
• Act as senior escalation point for high-severity incidents
• Design and maintain incident response playbooks and runbooks
• Ensure incident handling aligns with SLAs and regulatory obligations

• Architect and govern SIEM and EDR detection strategies
• Oversee detection lifecycle management
• Ensure detection logic reflects real-world attacker behavior
• Act as regional team lead / manager for SOC team members
• Mentor SOC leads, senior analysts, and engineers
• Serve as trusted advisor to leadership and clients
• Collaborate with Cyber Platform Engineering, vCISO, and Compliance teams

• 8+ years practical experience in cybersecurity with SOC or MSSP focus, including threat detection, incident response, and vulnerability management.
• Proficiency with SIEM tools (Stellarcyber, Level Blue, Splunk, QRadar, etc.) and vulnerability scanners (Tenable, Qualys etc.).
• Strong understanding of network protocols, operating systems (Windows/Linux), firewalls, IDS/IPS, VPN’s, cloud security platforms (AWS, Azure) and endpoint security solutions.
• Familiarity with security frameworks like MITRE, NIST, ISO 27001, or CIS benchmarks.
• Experience with incident response processes and malware analysis.
• Excellent analytical skills, attention to detail, and ability to work under pressure.
• Strong communication skills to effectively collaborate with technical and non-technical teams
• Having experience in a client-facing role is beneficial for offering insights into the client's security posture

• Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
• Relevant certifications are a plus, such as CISSP-ISSEP, CISSP-ISSAP, CEH (Certified Ethical Hacker), CompTIA CySA+, CompTIA CASP+ or equivalent.