SOC Team Lead

Job not on LinkedIn

🔥 1 minute ago

🇺🇸 United States – Remote

💵 $110k - $140k / year

⏰ Full Time

🟠 Senior

🛡️ Security Operations

👻 Ghost score 1%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

AHEAD

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

🤖 Artificial Intelligence

🏢 Enterprise

💰 $5.7M Venture Round - AHEAD on 2024-05

Consulting • Artificial Intelligence • Enterprise

AHEAD is a technology consulting and systems-integration firm that accelerates digital transformation by engineering integrated solutions across infrastructure, applications, data, and security. The company specializes in AI transformation and AI-enabled infrastructure, data platform and platform/workload modernization, secure and resilient architectures, operational excellence, and managed services including IT lifecycle and procurement (AHEAD Hatch) and hardware integration (AHEAD Foundry). AHEAD delivers end-to-end services from strategy and financial consulting to build and run operations, partners with major cloud and infrastructure vendors (AWS, Google Cloud, Microsoft, Cisco, Dell, VMware, NVIDIA, ServiceNow, Palo Alto Networks, Rubrik, etc. ), and serves enterprise clients across industries such as healthcare, financial services, manufacturing, retail, and public sector.

📋 Description

• Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model • Manage the alert and case queue, balance analyst workload, prioritize high-severity events, and ensure cases move with urgency and accountability • Serve as the primary quality-assurance checkpoint for the shift by reviewing cases for accuracy, completeness, and defensibility before escalation or client notification • Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions • Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership • Oversee the human-in-the-loop layer on top of agentic triage and suppression, ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context • Coach, mentor, and develop Tier 1 and Tier 2 analysts • Monitor and drive shift performance against MTTD, MTTR, MTTC, false-positive rate, and SLA attainment • Ensure adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to continuous improvement • Partner with detection engineering and Tier 2 to identify tuning and suppression opportunities and reduce recurring noise • Support client-facing communications during significant events • Escalate people, process, and platform issues to the SOC Manager

🎯 Requirements

• 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience • Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred • One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications • Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies • Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management • Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework • Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case • Working knowledge of detection tuning, alert suppression, and detection-as-code concepts • Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop • Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment • Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment • Excellent decision-making and judgment, especially under pressure and during active incidents • Outstanding verbal and written communication, including client-facing communication during significant events • Ability to uphold and enforce quality standards while developing people and maintaining team morale • Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously • Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation as required • Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications

🏖️ Benefits

• Medical, Dental, and Vision Insurance • 401(k) • Paid company holidays • Paid time off • Paid parental and caregiver leave • Multi-million-dollar technology lab • Cross-department training and development • Sponsored certifications and credentials for continued learning • AI application and resume review opt-out without penalty • Interview recording and transcription opt-out without penalty