Sobre este puesto de SOC Team Lead en Thinkahead
The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift.
This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes — not alert volume — and for meeting service-level commitments across a multi-tenant client base.
The ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team.
Summary of Essential Job Functions
-
Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.
-
Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.
-
Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.
-
Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions.
-
Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.
-
Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context.
-
Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.
-
Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.
-
Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.
-
Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.
-
Support client-facing communications during significant events, maintaining professionalism and clarity under pressure.
-
Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture.
Experience and Certifications
-
5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.
-
Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.
-
One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.
-
Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.
Technical Background Requirements
-
Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.
-
Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.
-
Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.
-
Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.
-
Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop.
-
Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.
Required Skills
-
Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.
-
Excellent decision-making and judgment, especially under pressure and during active incidents.
-
Outstanding verbal and written communication, including client-facing communication during significant events.
-
Ability to uphold and enforce quality standards while developing people and maintaining team morale.
-
Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.
-
Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation as required.
-
A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.
Education
-
Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.
