SOC Team Lead

AHEAD

10d•$110,000 - $140,000

About The Position

The SOC Team Lead is the operational owner of the Security Operations Center during an assigned shift and provides real-time accountability for service quality in AHEAD’s 24x7 follow-the-sun Managed Security Services. The role ensures client environments are covered and serves as the primary quality and escalation checkpoint for analysts on shift. This position combines hands-on security expertise with people leadership. The Team Lead manages alert and case queues, workload, and priorities; oversees agentic triage and human-in-the-loop validation; coaches Tier 1 and Tier 2 analysts; and coordinates active incident response. The role is accountable for high-fidelity, defensible outcomes and service-level commitments across a multi-tenant client base. The successful candidate makes sound decisions under pressure, communicates clearly, upholds quality standards, and develops the team. The role requires availability for a shift-based schedule, including nights, weekends, or holidays, and an on-call rotation as required. A bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field is required, or equivalent professional experience and certifications. The compensation range is $110,000–$140,000 per year in on-target earnings, comprising base salary and any applicable target bonus; the range may vary with relevant experience, qualifications, and geographic location.

Requirements

5–8 years of experience in security operations or incident response, including demonstrated Tier 2 or senior analyst experience.
Hands-on experience across SIEM, EDR/XDR, SOAR, and related security technologies.
Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.
Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.
Strong experience with SIEM platforms, including Elastic Security and Palo Alto Cortex XSIAM; EDR/XDR and SOAR; and case management and correlation from event to alarm to SOAR case.
Working knowledge of detection tuning, alert suppression, and detection-as-code concepts and how they improve fidelity and reduce noise.
Familiarity with AI-assisted and agentic security operations and the governance and guardrails needed for safe, auditable, human-in-the-loop autonomy.
Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP/MDR/MXDR environment.
Strong leadership presence and ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.
Excellent decision-making and judgment, especially under pressure and during active incidents.
Outstanding verbal and written communication, including client-facing communication during significant events.
Ability to uphold and enforce quality standards while developing people and maintaining team morale.
Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.
Availability to work a shift-based schedule, including nights, weekends, or holidays, and an on-call rotation as required.
Continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.
Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field, or equivalent professional experience and certifications.

Nice To Haves

Prior experience as a shift lead, team lead, or in a mentorship or quality-review capacity.
One or more preferred certifications: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks XSIAM/Cortex certifications.

Responsibilities

Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and accountable handoffs across the follow-the-sun model.
Manage the alert and case queue, balance analyst workloads, prioritize high-severity events, and ensure cases progress with urgency and accountability.
Review cases as the shift’s primary quality-assurance checkpoint for accuracy, completeness, and defensibility before escalation or client notification.
Provide technical guidance to analysts on complex investigations and make or support incident-declaration decisions as the first point of escalation.
Coordinate active incident response, including communications, task assignments, and status updates to clients and SOC leadership.
Oversee human-in-the-loop validation of agentic triage and suppression, ensuring AI-driven outcomes are validated, tuned, and enriched with client context.
Coach, mentor, and develop Tier 1 and Tier 2 analysts through real-time feedback and structured ramp-up and skills development.
Monitor and drive shift performance against MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.
Ensure adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.
Partner with detection engineering and Tier 2 to identify tuning and suppression opportunities and reduce recurring noise.
Support client-facing communications during significant events with professionalism and clarity.
Escalate people, process, and platform issues to the SOC Manager and contribute to a resilient, quality-focused, continuous-improvement culture.