SOC Team Lead (08:00–17:00 UTC)

Tether Operations Limited

20h•Remote

About The Position

The SOC Team Lead manages day-to-day operations of Tether’s global, follow-the-sun Security Operations Center. Based in Europe and covering the 08:00–17:00 UTC shift, the lead manages a distributed team of SOC Analysts and ensures security events are monitored, investigated, and handled effectively around the clock. The role sets operational standards, owns incident response processes, and improves the quality of investigations, shift handovers, detection, and response capabilities. It combines hands-on SOC work with team leadership in a fast-paced, fully remote environment.

Requirements

Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
At least 5 years of hands-on Security Operations experience, including at least 1 year as a SOC Lead or in an equivalent team lead role.
Proven experience triaging alerts, investigating security incidents, and leading responses to major incidents in a production environment.
Solid working knowledge of EDR, SSE, SIEM, and WAF technologies and their use in investigating and responding to threats.
Experience leading or working in a 24/7 or follow-the-sun SOC, including managing shift schedules and remote teams across time zones.
Strong experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework.
Excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles.
Strong leadership, analytical, troubleshooting, and problem-solving skills, with high attention to detail.
Ability to handle sensitive information responsibly and securely.
Excellent written and verbal English communication skills, including reporting to management and communicating clearly with technical and non-technical stakeholders during incidents.

Nice To Haves

Hands-on experience implementing, configuring, and tuning security platforms, or writing and tuning detection content.
Relevant certifications such as Security+, CySA+, GCIA, GCIH, GSOM, CISSP, or vendor-specific credentials.

Responsibilities

Lead, coach, and develop a distributed team of SOC Analysts working across regions in a follow-the-sun model.
Own SOC schedules and shift rotations, including weekend coverage, to ensure continuous coverage across time zones.
Define and enforce shift handover processes so open investigations, ongoing incidents, and pending actions continue seamlessly.
Serve as the team’s primary escalation point and lead major security incidents, coordinating triage, analysis, containment, eradication, recovery, and post-incident reviews.
Conduct hands-on triage, investigation, and threat hunting across SIEM, EDR, SSE, and WAF platforms.
Review investigation quality and incident documentation, provide structured feedback, and maintain consistent standards across shifts and regions.
Define, track, and report SOC metrics and KPIs, including alert volumes, mean time to detect, mean time to respond, and false positive rates.
Improve detection content with security engineering, including tuning SIEM correlation rules, EDR custom detections, and WAF rules, and mapping coverage to frameworks such as MITRE ATT&CK.
Develop and maintain technical documentation, standard operating procedures, incident response playbooks, and escalation matrices.
Contribute to hiring, onboarding, and training SOC Analysts.
Collaborate with IT, infrastructure, application, and security engineering teams, as well as management, to resolve incidents and support daily operations.
Support vulnerability management and continuously improve the organization’s security posture.