SOC Lead

Role overview Lead day-to-day operations for a global, around-the-clock security operations center, combining team leadership with hands-on investigation. You’ll coordinate incidents, strengthen shift handovers and investigation quality, and improve detection and response practices across a distributed team. The role is based in Europe and covers an 08:00–17:00 UTC shift within a follow-the-sun operation.

Responsibilities - Coach and develop SOC analysts working across regions and time zones; manage schedules and shift coverage, including weekends. - Set consistent handover practices so investigations, incidents, and follow-up actions carry across shifts. - Serve as the escalation point and lead major incident response from triage through recovery and post-incident review. - Investigate alerts and hunt for threats across SIEM, endpoint detection and response, security edge, and web application firewall systems. - Review case quality and documentation, track operational metrics, and report on alert volume, detection and response times, and false positives. - Improve detection rules and playbooks with security engineering, maintain operating procedures, and support analyst hiring and training.

Requirements - Degree in information technology, cybersecurity, computer science, or a related field, or equivalent practical experience. - 5+ years of hands-on security operations experience, including at least one year leading a team or equivalent. - Experience investigating security incidents and coordinating responses in a production environment. - Working knowledge of SIEM, endpoint security, security edge, and web application firewall tools. - Experience with 24/7 or follow-the-sun operations, remote teams, and shift handovers. - Strong incident response, threat hunting, communication, and analytical skills; understanding of network, endpoint, cloud security, and Zero Trust principles.

Nice to have - Experience configuring security platforms or developing and tuning detection content. - Familiarity with MITRE ATT&CK and certifications such as Security+, CySA+, GCIA, GCIH, GSOM, CISSP, or vendor credentials.

Benefits and work setup - Fully remote work with a globally distributed team.