Lead SOC Analyst

UFP Industries•Grand Rapids, MI

1d•Onsite

About The Position

The Lead SOC Analyst leads daily Security Operations Center (SOC) operations while participating hands-on in threat detection, investigation, and response. This player/coach role combines incident response with team leadership, process development, and SOC maturity initiatives. The analyst is the primary coordination point between the internal SOC and the external managed detection and response (MDR) provider, supporting effective monitoring, escalation, and response to security events. The role also develops and maintains SOC processes, playbooks, and documentation to strengthen the organization’s security posture. The position is full-time and on-site at the company’s Grand Rapids, Michigan office and reports to the Manager of Cyber Defense. The Lead SOC Analyst provides technical leadership to SOC analysts and collaborates with engineering, security, IT, infrastructure, application, and business teams, as well as stakeholders involved in audit, compliance, and risk management.

Requirements

Bachelor’s degree in computer science, information security, or equivalent experience.
At least 7 years of experience in a SOC, incident response, or cybersecurity operations role.
Proven experience leading incident investigations and managing escalations.
Strong understanding of security operations tools, including SIEM, XDR, EDR, and SOAR platforms.
Experience with detection tuning, threat hunting, and log analysis.
Demonstrated ability to develop SOC processes, playbooks, and operational documentation.
Strong leadership, mentoring, and team development skills.
Excellent analytical, problem-solving, and decision-making capabilities.
Strong written and verbal communication skills.
Ability to work full-time on-site at the Grand Rapids, Michigan office.

Nice To Haves

Experience working with a managed detection and response (MDR) provider.
Experience with Splunk, Microsoft Sentinel, Defender XDR, and/or similar platforms.
Experience working in a hybrid SOC model (internal plus MDR).
Familiarity with compliance frameworks such as NIST and CMMC.
Relevant certifications such as CISSP, GCIA, GCIH, or equivalent.

Responsibilities

Serve as the senior escalation point for security incidents, conducting hands-on investigation and response.
Perform advanced threat hunting, incident analysis, and root cause determination.
Lead and coordinate incident response across IT, infrastructure, and application teams.
Validate and enrich alerts from internal tools and the external MDR provider; ensure timely containment, remediation, and closure of incidents.
Act as the primary operational liaison with the MDR provider, managing alert triage alignment, escalations, service quality, and service reviews.
Review MDR detections, investigations, and recommendations for accuracy and relevance, and drive improvements to detection coverage, alert fidelity, and response processes.
Lead daily SOC operations, including alert prioritization, workload management, and escalation decisions.
Provide technical guidance, coaching, training, and knowledge sharing to SOC analysts; support hiring, onboarding, and skill development.
Establish expectations for investigation quality, documentation, and response timelines.
Develop, document, and maintain SOC standard operating procedures, playbooks, and runbooks.
Identify process gaps and implement improvements to SOC consistency and effectiveness.
Define and track SOC metrics and KPIs, such as MTTR, alert volume, false positives, and escalation rates.
Standardize incident documentation and evidence collection to support audit and compliance requirements.
Drive continuous improvement initiatives aligned with industry best practices and organizational goals.
Collaborate with engineering and security teams to improve detection logic and use cases.
Develop and tune detection rules within SIEM, XDR, and MDR platforms.
Identify logging and telemetry gaps and work with teams to onboard required data sources.
Ensure monitoring coverage for systems handling sensitive or critical data.
Contribute to threat modeling and detection strategy development.
Communicate security incidents, risks, and trends to technical and non-technical stakeholders, and report incident outcomes and lessons learned.
Partner with infrastructure, application, and business teams to improve security practices.
Support audit, compliance, and risk management activities as needed.