Security Operations Lead
Summary
Lead security operations (SOC) work: investigating incidents, validating alerts, and escalating threats while tuning SIEM/EDR detections and using scripting/automation. Requires deep knowledge of identity, endpoint, network, and cloud telemetry, plus technical leadership and coaching of analysts.
Skills, Qualifications & Experience
- SOC & Incident Response: Demonstrable hands-on experience in security operations and incident investigation,
including alert validation, evidence analysis, severity assessment, and timely escalation. Practical ability to
interrogate SIEM and EDR data, build and tune detections, and use scripting or automation safely. Deep
understanding of attacker behaviours and identity, endpoint, network, and cloud telemetry.
- Operational Leadership: Evidence of technical leadership: coordinating operational work, coaching colleagues,
improving investigation quality, and communicating clearly under pressure. Ability to maintain playbooks,
preserve evidence, work within change controls, and collaborate with engineering on remediation. Ability to
translate technical findings into business implications and use metrics for real service improvement.
- Certifications & Specialized Experience: Relevant incident response, threat hunting, or security operations
certifications (or equivalent practical experience). Experience in payment/transaction-sensitive environments,
cloud and identity investigations, purple-team exercises, detection-as-code, and safe orchestration of response
workflows. Familiarity with managed security service (MSSP) oversight is highly beneficial.