Cyber Security Lead Architect

Netrio•Golden Valley, MN

About The Position

The Cyber Security Lead Architect – SOC & Incident Response is the senior technical authority responsible for architecting, governing, and continuously improving security detection, response, and incident handling capabilities within a Managed Security Services Provider (MSSP) environment. This role bridges security architecture and frontline SOC execution, ensuring tools, detections, workflows, and response processes are designed for scale, speed, and consistency across multiple clients. The Lead Architect serves as the highest escalation point for complex incidents and ensures SOC operations remain defensible, repeatable, and mature.

Requirements

8+ years practical experience in cybersecurity with SOC or MSSP focus, including threat detection, incident response, and vulnerability management.
Proficiency with SIEM tools (Stellarcyber, LevelBlue, Splunk, QRadar, etc.) and vulnerability scanners (Tenable, Qualys etc.).
Strong understanding of network protocols, operating systems (Windows/Linux), firewalls, IDS/IPS, VPN’s, cloud security platforms (AWS, Azure) and endpoint security solutions.
Familiarity with security frameworks like MITRE, NIST, ISO 27001, or CIS benchmarks.
Experience with incident response processes and malware analysis.
Excellent analytical skills, attention to detail, and ability to work under pressure.
Strong communication skills to effectively collaborate with technical and non-technical teams
Having experience in a client-facing role is beneficial for offering insights into the client's security posture

Nice To Haves

Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
Relevant certifications are a plus, such as CISSP-ISSEP, CISSP-ISSAP, CEH (Certified Ethical Hacker), CompTIA CySA+, CompTIA CASP+ or equivalent.

Responsibilities

Define SOC architecture standards across SIEM, SOAR, EDR, XDR, and vulnerability platforms
Architect SOC workflows supporting 24x7 monitoring, triage, and escalation
Partner with SOC leadership to reduce alert noise and increase analyst effectiveness
Ensure SOC tooling scales across diverse client environments
Act as senior escalation point for high-severity incidents
Design and maintain incident response playbooks and runbooks
Provide architectural guidance during active incidents
Ensure incident handling aligns with SLAs and regulatory obligations
Architect and govern SIEM and EDR detection strategies
Oversee detection lifecycle management
Ensure detection logic reflects real-world attacker behavior
Act as regional team lead / manager for SOC team members
Mentor SOC leads, senior analysts, and engineers
Serve as trusted advisor to leadership and clients
Collaborate with Cyber Platform Engineering, vCISO, and Compliance teams