SOC Team Lead

AHEAD

. Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model .

Posted 10/27/2026full-timeRemote • United StatesSenior💰 $110,000 - $140,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in security operations and incident response, with a strong focus on SOC operations, incident management, and team leadership. Proficient in utilizing SIEM, EDR/XDR, and SOAR technologies while ensuring adherence to quality standards and operational metrics.

Highest-signal resume keywords

SOC Operations ManagementIncident Response CoordinationSIEM Platforms ExpertiseTeam Leadership and MentorshipQuality Assurance and Continuous Improvement

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security OperationsIncident ManagementSIEMEDRXDRSOARDetection TuningAlert SuppressionMITRE ATT&CK FrameworkOperational Security Metrics

Soft Skills

Decision-MakingCommunicationPrioritizationOrganizational SkillsCoaching

Tools & Technologies

Elastic SecurityPalo Alto Cortex XSIAMAI-Assisted Security OperationsCase Management SystemsEvent Correlation Tools

Certifications & Qualifications

GIAC GCIHGIAC GCIAGIAC GCFACompTIA CySA+CISSPCISMMicrosoft SC-200

Industry Keywords

24x7 MonitoringFollow-The-Sun ModelMulti-Tenant MSSPMDRMXDR

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model
Manage the alert and case queue, balance analyst workload, prioritize high-severity events, and ensure cases move with urgency and accountability
Serve as the primary quality-assurance checkpoint for the shift by reviewing cases for accuracy, completeness, and defensibility before escalation or client notification
Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions
Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership
Oversee the human-in-the-loop layer on top of agentic triage and suppression, ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context
Coach, mentor, and develop Tier 1 and Tier 2 analysts
Monitor and drive shift performance against MTTD, MTTR, MTTC, false-positive rate, and SLA attainment
Ensure adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to continuous improvement
Partner with detection engineering and Tier 2 to identify tuning and suppression opportunities and reduce recurring noise
Support client-facing communications during significant events
Escalate people, process, and platform issues to the SOC Manager

Requirements

What you’ll need

5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience
Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred
One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications
Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies
Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management
Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework
Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case
Working knowledge of detection tuning, alert suppression, and detection-as-code concepts
Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop
Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment
Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment
Excellent decision-making and judgment, especially under pressure and during active incidents
Outstanding verbal and written communication, including client-facing communication during significant events
Ability to uphold and enforce quality standards while developing people and maintaining team morale
Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously
Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation as required
Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications

Benefits

Comp & perks

Medical, Dental, and Vision Insurance
401(k)
Paid company holidays
Paid time off
Paid parental and caregiver leave
Multi-million-dollar technology lab
Cross-department training and development
Sponsored certifications and credentials for continued learning
AI application and resume review opt-out without penalty
Interview recording and transcription opt-out without penalty