Lead SOC Analyst -Triage, Detection Engineering & Threat Hunting

Role summary

You will be the senior analyst and shift lead on the SOC floor. You will investigate escalated alerts end to end, decide what is real, and either close it with evidence or hand a well-scoped incident to the Incident Responders. Between alerts, you will build and tune detections and run threat hunts so the SOC gets sharper every week. The role is pitched at 10 years because it carries shift-lead, mentoring and detection-engineering ownership.

Key responsibilities

Triage and investigation

• Investigate escalated alerts from CrowdStrike Falcon, Falcon Next-Gen SIEM, Entra ID, Azure and network/email sources.
• Correlate endpoint, identity, cloud and network evidence to confirm or rule out compromise.
• Perform first-response containment within agreed playbooks (host isolation, account disable, session revoke) and escalate to IR with a clear summary.
• Document every investigation with evidence, decisions and timelines.

Detection engineering

• Write, test and tune detection rules in Falcon Next-Gen SIEM (CrowdStrike Query Language / LogScale), mapped to MITRE ATT&CK.
• Reduce false positives and alert fatigue through tuning, enrichment and suppression logic.
• Build and maintain Falcon Fusion SOAR automation for enrichment, triage and response steps.
• Track detection coverage against ATT&CK and close priority gaps, including healthcare-relevant threats.

Threat hunting

• Run regular hypothesis-driven hunts using threat intelligence, ATT&CK techniques and recent incident learnings.
• Hunt for identity abuse in Entra ID and AD, living-off-the-land activity, persistence and lateral movement.
• Convert hunt findings into durable detections.

Shift leadership

• Lead the shift: assign work, ensure SLA adherence and run clean handovers.
• Mentor junior analysts and review their investigations for quality.
• Report shift metrics (alert volume, MTTD, MTTR, escalation quality) and drive process improvements.

Must-have skills

• 10 years in security, at least 6 in a SOC with hands-on L2 or L3 investigation.
• Strong CrowdStrike Falcon experience (Insight XDR console, Next-Gen SIEM queries, Fusion SOAR).
• Proven detection engineering: writing and tuning rules in a SIEM query language, with measurable false-positive reduction.
• Solid knowledge of Windows, Linux, Active Directory, Entra ID, Azure and M365 logs and attack patterns.
• Working knowledge of MITRE ATT&CK, the cyber kill chain and threat intelligence.
• Comfortable with 24x7 rotational shifts and leading a shift team.

Good to have

• Scripting in Python or PowerShell for enrichment and automation.
• Detection-as-code practices (version control, testing, peer review for rules).
• Healthcare or pharma SOC experience.
• Certifications: CrowdStrike CCFA/CCFH/CCFR, GCIA, GCIH, GCTI, BTL2, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• False-positive rate on top-volume detections cut significantly, with tuning documented.
• At least 20 new or reworked detections in production, each mapped to ATT&CK.
• A regular hunt cadence (for example, monthly) with findings feeding detections.
• Escalations to IR consistently well-scoped and evidence-backed.