Cyber Offense, SOC, and IR Lead
Core
Lead global Security Operations Center (SOC) and incident response operations, including detection engineering, threat hunting, and response coordination across endpoints, identities, cloud, and networks.
Role type
Senior IC Cybersecurity Operations Lead (SOC/IR)
Builds
Global SOC operating model, detection use cases, response playbooks, and automated workflows for enterprise security.
Domain
Cybersecurity / Enterprise Security Operations
Required skills
SOC leadership, incident response coordination, detection engineering, SIEM/SOAR/EDR management, threat hunting, MITRE ATT&CK alignment, security metrics, cross-functional collaboration
Preferred skills
Global SOC transformation, Incident Commander experience, Microsoft Sentinel/Defender XDR, cloud security (Azure/AWS/GCP), purple-team collaboration, managed detection and response management, GenAI-assisted SOC workflows
Technologies
SIEM, SOAR, EDR/XDR, Microsoft Sentinel, Microsoft Defender XDR, KQL, UEBA, Azure, AWS, GCP
Responsibilities
Lead daily SOC operations across monitoring, alert triage, investigation, and escalation; Own and mature SOC operating procedures and response playbooks; Build and tune detection use cases aligned to enterprise risks; Lead incident response coordination for security events; Establish SOC performance metrics and reporting; Oversee SOC analyst workflows and quality assurance; Coordinate with managed security service providers and internal teams; Drive continuous improvement through tabletop exercises and threat hunting.
Seniority
Senior, hands-on IC with leadership responsibilities
