SOC Team Lead

Job Description

|

Managed Security Services

• Security Operations Centre

Location:

UAE / Middle East (On-site)

Employment Type:

Full-Time

Department:
Managed Security Services - SOC

Experience:

5-8 Years (SOC / Incident Response)

Reports To:

Director of Managed Services

ITHR is a technology consulting and professional services organisation supporting enterprises across the UAE and Middle East with digital transformation, cybersecurity, ERP implementation, talent solutions, managed services, and custom application development. Our cybersecurity practice provides a comprehensive portfolio of services including Managed SOC, Digital Forensics & Incident Response (DFIR), Vulnerability Assessment & Penetration Testing (VAPT), Network Security, Brand Protection, Security Advisory, and Managed Security Services.

Our Managed SOC is a strategic service offering that delivers continuous threat monitoring, detection, and response capabilities to customers across the region. As we continue to expand our managed services portfolio, we are seeking a technically strong and operationally experienced SOC Team Lead to maintain the quality, consistency, and effectiveness of our security operations capabilities.

The SOC Team Lead is a senior hands‑on role responsible for the day‑to‑day leadership of the ITHR Security Operations team.

You will oversee a team of SOC analysts (L1/L2/L3), own the quality of detection and response across monitored customer environments, and serve as the primary escalation point for significant incidents.

This role combines technical depth with people leadership and operational excellence. You will contribute directly to threat detection and investigation activities while driving continuous improvements in analyst capability, detection engineering, playbook maturity, SIEM coverage, and customer communications.

You will work closely with DFIR specialists, delivery teams, account managers, and customer stakeholders while helping shape the evolution of the SOC practice as ITHR expands its managed security services capabilities.

• Lead, mentor, and develop a team of L1, L2, and L3 SOC analysts, owning shift coverage, performance management, and professional growth
• Serve as the primary escalation point for high‑severity and complex incidents across monitored customer environments
• Conduct and oversee threat detection, alert triage, investigation, and incident response activities while remaining actively involved in analysis and investigation work
• Lead threat hunting initiatives by proactively identifying indicators of compromise, attacker persistence mechanisms, lateral movement, and emerging threats
• Own and continuously improve SIEM correlation rules, detection logic, use cases, and alert tuning to reduce false positives and improve detection effectiveness
• Develop, maintain, and enforce incident response playbooks, operational runbooks, and escalation procedures to ensure consistent execution across the SOC
• Produce and review customer‑facing incident reports, security advisories, executive summaries, and monthly service reports to ensure clarity, accuracy, and business relevance
• Manage SLA adherence across detection, triage, escalation, containment, and response activities, identifying bottlenecks and implementing service improvements
• Collaborate with DFIR teams on post‑incident reviews, lessons learned exercises, and continuous enhancement initiatives
• Coordinate with customers and internal delivery teams during active incidents, providing updates, guiding containment actions, and managing stakeholder expectations
• Support customer onboarding activities including log source integration, use case development, baseline establishment, and initial detection tuning
• Stay current with the threat landscape, attacker methodologies, regional threat actors, and emerging attack trends, translating these insights into actionable improvements
• Support internal audits, compliance initiatives, customer assessments, and managed security governance activities as a technical authority

• 5-8 years of experience in security operations, with at least 2…