Security Operations Lead

Skills

About the Role

You will lead a global SOC and its 24/7 monitoring, alert triage, escalation, detection engineering, and SIEM operations. You will improve telemetry and detection quality, automate investigations, guide complex incident analysis, integrate AI-based SOC tools, and communicate risks and trends to stakeholders.

Requirements

• 7+ years in security operations
• 3+ years in a senior or lead capacity
• Experience with 24/7 SOC environments
• Experience with SIEM platforms
• Knowledge of GCP cloud security monitoring
• Knowledge of SaaS security monitoring and endpoint telemetry
• Knowledge of Kubernetes and container detection
• Detection engineering, event correlation, threat hunting, and log analysis skills
• Familiarity with AI-based SOC platforms and LLM-driven tools
• Knowledge of identity security, OAuth, OIDC, and API telemetry
• Experience with SOAR and Python, Go, or Bash
• Knowledge of MITRE ATT&CK and detection lifecycle management

Responsibilities

• Lead, mentor, and scale a global 24/7 SOC team
• Build SOC processes, runbooks, SLAs, metrics, and quality standards
• Evaluate and integrate AI-native SOC technologies
• Own SIEM ingestion, normalization, correlation, enrichment, tuning, dashboards, and metrics
• Expand and standardize security telemetry
• Develop detections using MITRE ATT&CK and threat intelligence
• Lead triage, threat analysis, investigations, and root-cause analysis
• Refine detection logic and reduce false positives
• Coordinate monitoring and response readiness with technical teams
• Communicate threats, gaps, and trends to stakeholders

Benefits

• Equity
• 401(k) program with 4% match
• Health, dental, vision, and life insurance
• Short-term and long-term disability insurance
• Paid parental, medical, and caregiver leave
• Flexible time off and holidays
• Commuter benefits
• Monthly wellness stipend
• In-office setup reimbursement
• Quarterly team gatherings
• In-office amenities