Team Lead - SOC

Summary:

SOC Lead with extensive experience in leading cybersecurity incident response operations, managing Security Operations Center (SOC) teams, and handling complex security escalations. Skilled in SIEM platforms including ArcSight and LogRhythm, with expertise in Threat Intelligence, Malware Analysis, Incident Response, and deep-dive forensic investigations. Proven ability to develop and implement runbooks, playbooks, and SOPs while mentoring high-performing teams and driving continuous security improvements.

Knowledge & Technical Skills:

• Expertise in SOC and Incident Management and Investigation
• Experience in SIEM Tool like ArcSight, LogRhythm SIEM and Threat Intelligence, Malware Analysis and Incident Response
• Develop and maintain use cases, detection rules, and security monitoring content based on MITRE Framework.
• Good to have knowledge and experience in Advance SOC environment, SOC automation, AI usage in SOC.
• Maintains awareness of new and emerging cyber-attack threats with potential to harm company systems and networks. Devises and implements countermeasures to mitigate potential security threats.
• Knowledge about other various  tools and technologies, like –  SSL, Packet Analysis, HIPS/NIPS, Network Monitoring tools, Remedy, Ticketing Toolset Web Security, UBEA, Advanced SOC
• Perform threat hunting and proactive security investigations.

Roles and Responsibilities

• Coordinate and lead incident response activities for cybersecurity incidents.
• Ensure timely escalation, containment, eradication, and recovery from security incidents.
• Experience in handling P1 incident, driving investigation till closure.
• Lead complex investigations, handle critical escalations from L1/L2 teams, and perform root-cause analysis
• Experience in team management and mentoring.
• Provide analysis and trending of security log data from  security devices.
• Support security audits, compliance, and governance requirements.
• Creation of bi-weekly and monthly Operational/KPI reports
• Assists with the development and maintenance of IT security measurement and reporting systems to aid in monitoring effectiveness of IT Security programs.
• Ensure timely escalation, containment, eradication, and recovery from security incidents.
• Creating runbooks/playbooks and SOPs
• 24x7 on call support to team members.