Description

Key Responsibilities

• Lead Tier I/II/III SOC operations with full escalation authority.
• Enforce SLA-driven performance standards (≤15 min triage, ≤1 hr investigation, ≤2 hr escalation).
• Oversee the incident lifecycle from triage through investigation, response, and closure.
• Act as incident commander during high-severity events, coordinating stakeholder communication.
• Review and approve incident classifications, escalations, and remediation actions.
• Conduct daily/weekly operational reviews, tracking incident trends and performance metrics.
• Collaborate with engineering teams to improve detection rules and reduce false positives.
• Ensure all incidents are documented and audit-ready for compliance assessments.

Required Skills & Qualifications

• 8–10+ years of experience in SOC operations and incident management.
• Strong expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms (Splunk, QRadar, ELK).
• Proven ability to lead cross-functional SOC teams and enforce SLA compliance.
• Hands-on experience with ServiceNow, Jira, Power BI, KQL, and Log Analytics.
• Deep knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks.

Certifications (Preferred / Mandatory)

• CISSP (Certified Information Systems Security Professional)
• GIAC (GCIH / GCIA / GCFA)
• Microsoft Certified: Security Operations Analyst (SC-200)
• ITIL / PMP (optional but valuable for governance)

Key Skills

Education

Any Graduate