Security Operations Center (SOC) Technical Lead

MAD Security • Huntsville, AL

11d • Onsite

About The Position

The SOC Technical Lead owns the technical standards and platform supporting MAD Security’s 24/7 Security Operations Center in Huntsville, Alabama. The role is responsible for detection content, the security platform, incident command, and engineering project outcomes. The Technical Lead leads Tier 3 analysts and works alongside the SOC Desk Manager, who runs day-to-day operations. MAD Security integrates, engineers, and tunes security tools, with Elastic Security on Elastic Cloud Gov at the center of its platform.

The role provides technical direction for platform stability, integrations, detection engineering, incident response, and penetration testing engagements. It also develops Tier 3 analysts, communicates with technical, executive, and client audiences, and engineers AI-assisted triage and response with human oversight on critical decisions.

This is a full-time, exempt, onsite position at MAD Security’s headquarters and 24/7 SOC in Huntsville, Alabama. The schedule is weekday business hours with scheduled on-call duties and occasional travel for client meetings and industry events. The SOC is staffed by U.S. personnel, and the successful candidate must be a U.S. person.

Requirements

• At least eight years of experience in information security and/or IT, including significant SOC experience as a senior or lead analyst, detection engineer, or security architect.
• Ability to serve as incident commander on declared incidents, or as backup, including scoping, containment decisions, and evidence handling.
• Experience operating a SIEM platform at scale across multiple clients or business units.
• Bachelor’s degree in Information Technology, Information Security, or Computer Science, or equivalent experience.
• Deep expertise in detection engineering, incident response, threat hunting, platform administration, and security architecture.
• Expert knowledge of SIEM platforms, including ingestion, retention, integrations, and performance at scale.
• Ability to write technical standards others can follow.
• Familiarity with AI and automation in a SOC, with sound judgment about human oversight.
• Working knowledge of penetration testing methodology and deliverables sufficient to scope an engagement, judge test quality, and present findings to a client.
• Must be a U.S. person.

Nice To Haves

• CISSP, CompTIA SecurityX (formerly CASP+), or CCSP certification; GCIA, GCFA, GCIH, or GDAT are listed as alternate preferred certifications.
• Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
• Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
• Experience leading a technical team in an MSP/MSSP.

Responsibilities

• Own the SOC platform and its integrations, including stability, performance at scale, and change approval.
• Own the detection content and rule review standards, and maintain validated detection coverage.
• Write and publish SOC technical standards; approve architecture and platform changes and deviations.
• Serve as incident commander on declared incidents, or as backup, including scoping, containment decisions, and evidence handling.
• Own engineering project outcomes, platform stability, and tool integration.
• Own the execution, reporting, and project management of technical testing (penetration testing), including scoping and scheduling engagements, managing quality, and presenting findings and remediation to clients.
• Lead, coach, and develop Tier 3 analysts, ensuring each understands the Tier 2 and Tier 1 roles their work supports.
• Own detection engineering and develop AI-assisted triage and response with human oversight on critical decisions.
• Communicate with technical, executive, and client audiences during and after incidents.
• Manage platform stability, ingestion, and retention to published standards and operate a working change and deviation process.
• Ensure production detections pass peer review against a written standard, are managed as code, and have coverage validated on a schedule.
• Ensure incidents have a commander, documented containment decisions, preserved evidence, and recorded improvements.
• Deliver engineering projects end to end and ensure clients receive actionable penetration testing findings.
• Put agentic triage into production with a defined oversight boundary and reduce false positives and alert-to-notify time from baseline.
• Resolve recurring cross-client problems at the platform level.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior