Description

Lead Tier I-III SOC operations, managing incident lifecycles and enforcing strict SLA compliance for triage, investigation, and escalation.

This role is remote.

Responsibilities

• Enforce SLA-driven performance standards, ensuring ≤15 min triage, ≤1 hr investigation, and ≤2 hr escalation.
• Act as incident commander during high-severity events, coordinating stakeholder communication and resolution.
• Review and approve incident classifications, escalations, and remediation actions to maintain audit readiness.
• Conduct daily and weekly operational reviews to track incident trends, performance metrics, and false positive reduction.
• Collaborate with engineering teams to improve detection rules and enhance overall security posture.

Required Skills

• 8–10+ years of experience in SOC operations and incident management.
• Deep expertise in Microsoft Sentinel, Defender XDR, and SIEM/SOAR platforms including Splunk, QRadar, and ELK.
• Hands-on proficiency with ServiceNow, Jira, Power BI, KQL, and Log Analytics.
• Strong knowledge of NIST SP 800-53, NIST 800-61, FISMA, and FedRAMP frameworks.
• Proven ability to lead cross-functional SOC teams and enforce compliance.

Preferred Skills

• CISSP, GCIH, GCIA, or GCFA certifications.
• Microsoft Certified: Security Operations Analyst (SC-200).
• ITIL or PMP certification for governance.

Key Skills

Education

Any Graduate