Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will lead security detection and response operations while remaining hands-on with engineering work. You will manage incidents, develop detection pipelines, perform forensics and threat hunting, automate analyst workflows, and coordinate response activities across security and business functions.
Requirements
- 8+ years of hands-on SOC operations threat detection and incident response experience
- 2+ years of people management or formal team leadership experience
- Experience investigating cloud-native threats
- Experience with Kubernetes Docker and SaaS infrastructure
- Advanced proficiency with SIEM EDR XDR log aggregation and SOAR tools
- Scripting skills in Python Bash or Go
- Knowledge of network protocols cloud architecture identity systems and digital forensics
- Experience with financial services FinTech digital assets or trading environments
- Relevant GIAC CISSP or OSCP certification
Responsibilities
- Lead and mentor SOC analysts and incident response engineers
- Manage high-severity incident escalations and continuous coverage
- Define and track SOC operational metrics
- Drive end-to-end security incident response
- Design and tune SIEM EDR and cloud detection rules
- Perform digital forensics and suspicious payload analysis
- Research emerging threats and vulnerabilities
- Lead red team purple team and tabletop exercises
- Hunt for undetected threat activity
- Build automated response playbooks