Security Operations Center Architect

Sigma Suisse, based in Plan-les-Ouates, is a recruitment firm specialised in IT and strategic profiles, supporting leading organisations across French-speaking Switzerland.

Within our IT department, we cover hiring needs in Commodity and Financial Trading, Pharmaceuticals, Aeronautics, Space, Energy, Watchmaking and Swiss foundations.

Our client is looking for a Security Operations Lead to build, run and continuously improve its internal Security Operations Centre.

Based in Geneva, with London also possible, you will combine hands-on cyber defence as a senior L2/L3 incident handler with leading a SOC team. You will report to the CISO.

Key responsibilities

• Lead and develop a distributed SOC team, with 24/7 follow-the-sun coverage and consistent service quality
• Define SOC procedures, escalation paths, shift handovers and KPIs (MTTD, MTTR, false-positive rate)
• Act as the main interface with the outsourced SOC provider, oversee its performance and drive improvements
• Own the detection engineering lifecycle in Microsoft Sentinel (KQL), with coverage mapped to MITRE ATT&CK
• Bring in threat intelligence feeds and lead proactive threat hunting
• Lead complex incident response from triage to recovery, working with IT, Legal and Compliance
• Run post-incident reviews and root-cause analysis, then turn the findings into new detections and process updates
• Write and test playbooks and runbooks (phishing, ransomware, BEC, insider threat, cloud compromise, data exfiltration)
• Run tabletop and purple-team exercises with the internal Red Team
• Report on SOC performance, threat landscape and risk posture to the CISO and senior stakeholders

Required experience

• 4+ years in cybersecurity operations, incident response or security engineering
• Proven experience leading a SOC team, including remote or distributed staff
• Solid understanding of SOC operating models (tiered, hybrid, follow-the-sun)
• Track record of building or significantly improving detection and response capabilities
• Microsoft Sentinel (KQL), Defender for Endpoint, CrowdStrike Falcon
• Cloud security on AWS (GuardDuty, CloudTrail, Security Hub) and Azure (Defender for Cloud, Entra ID Protection), plus Wiz
• Microsoft Purview, Varonis, Zscaler (ZIA/ZPA), Palo Alto (NGFW, Panorama, Cortex)
• Digital forensics, malware analysis, NIST CSF and NIST 800-61
• Strong communication skills, able to explain technical findings to executives

Nice to have

• Certifications: CISSP, CISM, GCIH, GCIA, GCED, SC-200, AZ-500
• Background in commodity trading, energy or financial services
• Experience with SOAR, Python and PowerShell scripting