SOC Team Lead (Tier 1)

Recenso; Abu Dhabi; On-site; AED 200,000 - 250,000; Full time

Benefits offered by this job

Professional development opportunities

Leadership roles

Collaborative environment

Job summary

A leading cybersecurity firm is seeking an experienced SOC Team Lead in Abu Dhabi to manage daily operations in a 24/7 Security Operations Center. This role involves coordinating SOC activities, leading a team of analysts, overseeing incident management, and improving detection capabilities. Ideal candidates will have over 7 years in cybersecurity operations and proven leadership experience. The firm offers an opportunity to influence SOC strategies and collaborate with a high-performing team.

Qualifications

• 7+ years of experience in cybersecurity operations, with 3 years in SOC leadership or senior analyst role.
• Proven experience leading SOC teams and managing workflows.
• Deep technical knowledge of SIEM, SOAR, EDR platforms.

Responsibilities

• Manage daily operations in a 24/7 SOC.
• Supervise SOC analysts and engineers.
• Oversee daily monitoring and incident management workflows.

Skills

Management skills

Incident response

Communication skills

Stakeholder management

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

Elastic Stack

Splunk

Microsoft Sentinel

CrowdStrike

Job description

SOC Team Lead

Company Overview

Our client is a leading cybersecurity firm establishing a next-generation Security Operations Center (SOC) to deliver world‑class monitoring, detection, and incident response capabilities. Built on advanced analytics, automation, and threat intelligence, this SOC is designed to serve as a central pillar of enterprise defense across diverse digital environments. The company is seeking exceptional security professionals to shape, lead, and evolve this capability into a benchmark for operational excellence and resilience.

Role: SOC Team Lead

Location: Abu Dhabi, UAE

Job Summary

We are seeking an experienced SOC Team Lead to manage daily operations within a 24/7 Security Operations Center. This role acts as the primary focal point for all SOC activities — ensuring seamless coordination between analysts, engineering teams, and senior leadership. The SOC Team Lead will drive operational performance, enhance detection and response capabilities, and ensure that the SOC functions as a highly reliable, intelligence‑driven defense unit.

Key Responsibilities

• Serve as the central coordination point for all SOC activities and report to Management
• Lead and supervise a team of SOC analysts (L1–L3) and engineers, ensuring 24/7 operational coverage.
• Oversee daily monitoring, triage, and incident management workflows.
• Act as the primary escalation point during major incidents and coordinate response actions.
• Define, maintain, and continuously improve SOC playbooks, workflows, and escalation procedures.
• Review and optimize SIEM correlation rules, dashboards, and alerts to enhance detection quality.
• Track and report on SOC KPIs and metrics such as MTTD, MTTR, incident volume, and closure rates.
• Collaborate with IT, cloud, and compliance teams to align detection and response with enterprise policies.
• Ensure adherence to recognized security frameworks (MITRE ATT&CK, ISO 27001, NIST 800-61).
• Support strategic initiatives led by Management, including automation, maturity assessments, and technology upgrades.
• Mentor and develop SOC analysts, fostering continuous learning and technical growth.
• Represent the SOC in cross‑departmental meetings, incident reviews, and management briefings.

Role Requirements

• 7+ years of experience in cybersecurity operations, with at least 3 years in a SOC leadership or senior analyst role.
• Proven experience leading SOC teams and managing operational workflows.
• Deep technical knowledge of SIEM, SOAR, and EDR platforms (Elastic, Splunk, Sentinel, Defender, CrowdStrike).
• Hands‑on experience with incident response, forensics, and detection engineering.
• Strong understanding of threat frameworks, logging pipelines, and automation.
• Excellent communication and stakeholder management skills.
• Bachelor’s degree in Computer Science, Cybersecurity, or a related field.
• Preferred certifications: CISSP, CISM, GCIH, or equivalent.

Technical Skills

• Platforms: Elastic Stack, Splunk, Microsoft Sentinel, Defender, CrowdStrike
• Frameworks: MITRE ATT&CK, NIST 800-61, ISO 27001, CIS Controls
• Tools: SIEM, SOAR, EDR, IDS/IPS, threat intelligence platforms
• Processes: Incident triage, containment, threat hunting, root cause analysis
• Automation: Python, PowerShell scripting, and orchestration workflows

Why Join Us

• Lead a next‑generation SOC within a rapidly evolving cybersecurity environment.
• Influence SOC strategy, tooling, and future capability expansion.
• Collaborate with a high‑performing technical and leadership team.
• Access ongoing professional development and leadership opportunities.

About the Selection Process

Our recruitment process is designed to evaluate both technical expertise and leadership ability. Shortlisted candidates will participate in an initial interview to discuss operational management experience, detection strategies, and leadership style. Subsequent stages may include scenario‑based assessments to evaluate situational awareness, decision‑making, and cultural alignment. Final candidates will have the opportunity to engage with the wider security leadership team to explore collaboration style, communication, and long‑term career progression.