SOC TEAM LEAD

Job Summary

We are seeking an experienced and proactive SOC Team Lead to oversee daily security operations, guide incident response efforts, and lead a team of SOC Analysts. In this role, you will be responsible for real-time monitoring, detection, containment, and remediation of security threats across our hybrid infrastructure.

You will act as the operational bridge between Tier 1/ Tier 2 analysts, senior security management, and cross-functional teams, ensuring operational readiness, continuous tuning of detection tools, and strict adherence to SLAs and regulatory requirements (e.g., ISO 27001, PDPA, RMIT).

Key Responsibilities

1. Operations & Threat Detection Management

• Lead daily SOC operations, ensuring 24/7/365 coverage, event triage, and alert prioritization across SIEM, EDR, NDR, and cloud platforms.
• Manage high-priority security incidents (P1/P2) from detection through post-incident root cause analysis (RCA) and reporting.
• Continuously refine, update, and optimize SOC playbooks, threat detection rules, and automation/SOAR workflows to reduce false positives and alert fatigue.
• Monitor key operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

2. Team Leadership & Mentorship

• Directly supervise, mentor, and evaluate Tier 1 and Tier 2 SOC Analysts.
• Conduct regular shift handovers, team training, shift schedules, and operational performance reviews.
• Develop continuous learning plans, certifications, and technical skills uplift for team members.

3. Compliance, Audit & Continuous Improvement

• Ensure SOC operations align with organizational security policies, ISO 27001 ISMS standards, and relevant regulatory frameworks.
• Assist in internal and external audit preparation by providing evidence, incident logs, and SLA compliance reports.
• Conduct periodic Business Impact Analyses (BIA) and risk assessments for security monitoring processes.
• Perform regular threat hunting exercises and purple teaming sessions to identify coverage gaps in the MITRE ATT&CK framework.

Required Qualifications & Experience

• Experience: 3+ years of experience in cybersecurity operations, with at least 2+ years in a senior or supervisory SOC role.

• Technical Expertise:

  • In-depth knowledge of SIEM tools (e.g., Splunk, StellarCyber, QRadar, Elastic) and EDR solutions (e.g., CrowdStrike, Defender for Endpoint).
  • Strong mastery of network protocols, threat vectors, attack tactics (MITRE ATT&CK), and log analysis (Windows, Linux, Cloud logs).
  • Hands-on experience with SOAR platforms and script development (Python, PowerShell, Bash) for automation.

• Process & Frameworks: Solid understanding of Incident Response frameworks (NIST SP 800-61, ISO/IEC 27035) and information security standards (ISO 27001, SOC 2).

• Soft Skills: Excellent crisis management, analytical problem-solving, and verbal/written communication skills to interface with stakeholders during incident escalations.