Lead SOC Analyst

UFP Industries•Grand Rapids, MI

12d•Onsite

About The Position

The Lead SOC Analyst leads daily Security Operations Center (SOC) operations while actively participating in threat detection, investigation, and response. The role operates in a player/coach capacity, balancing hands-on incident response with team leadership, process development, and SOC maturity initiatives. It serves as the primary coordination point between the internal SOC and the external managed detection and response (MDR) provider, supporting effective monitoring, escalation, and response to security events. The role develops and maintains SOC processes, playbooks, and documentation to improve the organization’s security posture. This position reports to the Manager of Cyber Defense and is on-site, full-time at the company’s Grand Rapids, Michigan office.

Requirements

Bachelor’s degree in computer science, information security, or equivalent experience.
7+ years of experience in a SOC, incident response, or cybersecurity operations role.
Proven experience leading incident investigations and managing escalations.
Strong understanding of security operations tools, including SIEM, XDR, EDR, and SOAR platforms.
Experience with detection tuning, threat hunting, and log analysis.
Demonstrated ability to develop SOC processes, playbooks, and operational documentation.
Strong leadership, mentoring, and team development skills.
Excellent analytical, problem-solving, and decision-making capabilities.
Strong written and verbal communication skills.

Nice To Haves

Experience working with a managed detection and response (MDR) provider.
Experience with Splunk, Microsoft Sentinel, Defender XDR, and/or similar platforms.
Experience working in a hybrid SOC model (internal and MDR).
Familiarity with compliance frameworks such as NIST and CMMC.
Relevant certifications such as CISSP, GCIA, GCIH, or equivalent.

Responsibilities

Act as the senior escalation point for security incidents and conduct hands-on investigation and response.
Perform advanced threat hunting, incident analysis, and root cause determination.
Lead and coordinate incident response across IT, infrastructure, and application teams.
Validate and enrich alerts from internal tools and the external MDR provider.
Ensure timely containment, remediation, and closure of security incidents.
Serve as the primary operational liaison with the MDR provider, managing alert triage alignment, escalations, and service quality.
Review MDR detections, investigations, and recommendations for accuracy and relevance; drive improvements in detection coverage, alert fidelity, and response processes.
Participate in service reviews and ensure MDR deliverables meet organizational expectations.
Provide technical leadership and guidance to SOC analysts; lead daily prioritization, workload management, and escalation decisions.
Mentor and develop analysts through coaching, training, and knowledge sharing; establish expectations for investigation quality, documentation, and response timelines.
Support hiring, onboarding, and skill development of SOC team members.
Develop, document, and maintain SOC standard operating procedures, playbooks, and runbooks.
Identify SOC process gaps and implement improvements; define and track metrics and KPIs such as MTTR, alert volume, false positives, and escalation rates.
Standardize incident documentation and evidence collection to support audit and compliance requirements.
Drive continuous improvement aligned with industry best practices and organizational goals.
Collaborate with engineering and security teams to improve detection logic and use cases; develop and tune detection rules within SIEM, XDR, and MDR platforms.
Identify logging and telemetry gaps and work with teams to onboard required data sources.
Ensure monitoring coverage for systems handling sensitive or critical data; contribute to threat modeling and detection strategy development.
Communicate security incidents, risks, and trends to technical and non-technical stakeholders, and report incident outcomes and lessons learned.
Partner with infrastructure, application, and business teams to improve security practices; support audit, compliance, and risk management activities as needed.