Lead SOC Architect — Threat Hunting & Incident Response

Sigma Suisse; Genf; Hybrid; CHF 120,000 - 190,000; Full time

Job summary

Sigma Suisse is seeking a Security Operations Lead in Geneva (with London option) to build, run and continuously improve its internal Security Operations Centre. The role combines hands-on cyber defence as a senior incident handler with leading a SOC team, reporting to the CISO.

You will define SOC processes, manage a 24/7 follow-the-sun operation, coordinate with outsourced SOC, develop detection engineering in Microsoft Sentinel, and drive threat hunting and post-incident reviews.

Qualifications

• 4+ years in cybersecurity operations, incident response or security engineering.
• Proven experience leading a SOC team, including remote or distributed staff.
• Solid understanding of SOC operating models (tiered, hybrid, follow-the-sun).
• Track record of building or significantly improving detection and response capabilities.
• Cloud security on AWS and Azure, plus Wiz.
• Digital forensics, malware analysis, NIST CSF and NIST 800-61.
• Strong communication skills, able to explain technical findings to executives.

Responsibilities

• Lead and develop a distributed SOC team with 24/7 follow-the-sun coverage.
• Define SOC procedures, escalation paths and KPIs.
• Interface with outsourced SOC provider and drive improvements.
• Own detection engineering in Microsoft Sentinel mapped to MITRE ATT&CK.
• Lead proactive threat hunting and incorporate threat intel feeds.
• Lead complex incident response from triage to recovery with IT, Legal and Compliance.
• Conduct post-incident reviews and translate findings into new detections.
• Write and test playbooks and runbooks for phishing, ransomware, etc.
• Run tabletop and purple-team exercises with the internal Red Team.
• Report SOC performance and risk posture to CISO and executives.

Skills

Cybersecurity ops

Incident response

SOC leadership

AWS security

Azure security

Threat hunting

MITRE ATT&CK

Executive communication

Tools

AWS GuardDuty

AWS CloudTrail

AWS Security Hub

Azure Defender for Cloud

Entra ID Protection

Wiz

Job description

Sigma Suisse is seeking a Security Operations Lead in Geneva (with London option) to build, run and continuously improve its internal Security Operations Centre. The role combines hands-on cyber defence as a senior incident handler with leading a SOC team, reporting to the CISO.

You will define SOC processes, manage a 24/7 follow-the-sun operation, coordinate with outsourced SOC, develop detection engineering in Microsoft Sentinel, and drive threat hunting and post-incident reviews.