Cyber Offense, SOC, and IR Lead

Job Details:

Job Description:

As the Cyber Offense, SOC, and Incident Response Lead, you will lead the day-to-day operations and continued evolution of our global Security Operations Center (SOC) and incident response capabilities. You will serve as a key leader within the cybersecurity organization, responsible for ensuring the organization can effectively detect, investigate, contain, and respond to cyber threats across endpoints, identities, cloud environments, networks, and critical enterprise systems.

This role combines security operations leadership, incident response, detection engineering, and continuous improvement. You will establish and mature SOC processes, response playbooks, escalation procedures, operational metrics, and global handoff models while working closely with security engineering, IT, cloud, identity, threat intelligence, and other cross-functional teams. You will lead the response to significant security incidents, coordinate investigations and incident communications, and help drive the organization toward faster and more consistent detection and containment.

You will also leverage automation, SOAR capabilities, threat intelligence, threat hunting, and MITRE ATT&CK-aligned detection strategies to improve the effectiveness and scalability of the SOC.

• Lead daily SOC operations across monitoring, alert triage, investigation, escalation, incident response coordination, and operational handoff across global time zones.
• Own and mature SOC operating procedures, including incident intake, severity classification, escalation paths, response playbooks, major incident communications, and post-incident reviews.
• Manage and improve security monitoring across SIEM, SOAR, EDR/XDR, email security, cloud security, identity security, vulnerability signals, network telemetry, and threat intelligence sources.
• Build, tune, and continuously improve detection use cases aligned to enterprise risks, MITRE ATT&CK techniques, threat intelligence, audit findings, and business‑critical assets.
• Partner with security engineering teams to improve log onboarding, data quality, telemetry coverage, alert fidelity, automation, and response integrations.
• Lead incident response coordination for security events involving endpoint compromise, identity misuse, phishing, malware, data loss indicators, cloud misconfigurations, suspicious network activity, and unauthorized access attempts.
• Establish SOC performance metrics and reporting, including alert volumes, false‑positive rates, SLA adherence, escalation quality, mean time to detect, mean time to acknowledge, mean time to contain, and incident trends.
• Oversee SOC analyst workflows, shift handoffs, case documentation, evidence handling, and quality assurance reviews.
• Coordinate with managed security service providers, internal IT teams, and business stakeholders to ensure timely response and clear ownership of remediation actions.
• Support implementation and operationalization of SOAR playbooks, automation workflows, enrichment logic, and incident response runbooks.
• Drive continuous improvement through tabletop exercises, incident retrospectives, purple‑team findings, threat hunting outputs, and lessons learned.
• Maintain alignment with security governance, regulatory, privacy, and audit requirements by ensuring SOC processes are documented, repeatable, measurable, and evidence‑ready.
• Serve as a security operations lead for global SOC coverage and cross‑functional collaboration.

• Improved detection coverage across high‑risk assets, identity systems, cloud services, endpoints, and enterprise applications.
• Reduced false positives and improved alert quality through tuning, enrichment, and automation.
• Faster and more…