Security Operations Center Architect

Sigma Suisse; Genf; Hybrid; CHF 120,000 - 190,000; Full time

Job summary

Sigma Suisse is seeking a Security Operations Lead in Geneva (with London option) to build, run and continuously improve its internal Security Operations Centre. The role combines hands-on cyber defence as a senior incident handler with leading a SOC team, reporting to the CISO.

You will define SOC processes, manage a 24/7 follow-the-sun operation, coordinate with outsourced SOC, develop detection engineering in Microsoft Sentinel, and drive threat hunting and post-incident reviews.

Qualifications

• 4+ years in cybersecurity operations, incident response or security engineering.
• Proven experience leading a SOC team, including remote or distributed staff.
• Solid understanding of SOC operating models (tiered, hybrid, follow-the-sun).
• Track record of building or significantly improving detection and response capabilities.
• Cloud security on AWS and Azure, plus Wiz.
• Digital forensics, malware analysis, NIST CSF and NIST 800-61.
• Strong communication skills, able to explain technical findings to executives.

Responsibilities

• Lead and develop a distributed SOC team with 24/7 follow-the-sun coverage.
• Define SOC procedures, escalation paths and KPIs.
• Interface with outsourced SOC provider and drive improvements.
• Own detection engineering in Microsoft Sentinel mapped to MITRE ATT&CK.
• Lead proactive threat hunting and incorporate threat intel feeds.
• Lead complex incident response from triage to recovery with IT, Legal and Compliance.
• Conduct post-incident reviews and translate findings into new detections.
• Write and test playbooks and runbooks for phishing, ransomware, etc.
• Run tabletop and purple-team exercises with the internal Red Team.
• Report SOC performance and risk posture to CISO and executives.

Skills

Cybersecurity ops

Incident response

SOC leadership

AWS security

Azure security

Threat hunting

MITRE ATT&CK

Executive communication

Tools

AWS GuardDuty

AWS CloudTrail

AWS Security Hub

Azure Defender for Cloud

Entra ID Protection

Wiz

Job description

Sigma Suisse, based in Plan-les-Ouates, is a recruitment firm specialised in IT and strategic profiles, supporting leading organisations across French-speaking Switzerland.

Within our IT department, we cover hiring needs in Commodity and Financial Trading, Pharmaceuticals, Aeronautics, Space, Energy, Watchmaking and Swiss foundations.

Our client is looking for a Security Operations Lead to build, run and continuously improve its internal Security Operations Centre.

Based in Geneva, with London also possible, you will combine hands-on cyber defence as a senior L2/L3 incident handler with leading a SOC team. You will report to the CISO.

Key responsibilities

• Lead and develop a distributed SOC team, with 24/7 follow-the-sun coverage and consistent service quality
• Define SOC procedures, escalation paths, shift handovers and KPIs (MTTD, MTTR, false-positive rate)
• Act as the main interface with the outsourced SOC provider, oversee its performance and drive improvements
• Own the detection engineering lifecycle in Microsoft Sentinel (KQL), with coverage mapped to MITRE ATT&CK
• Bring in threat intelligence feeds and lead proactive threat hunting
• Lead complex incident response from triage to recovery, working with IT, Legal and Compliance
• Run post-incident reviews and root-cause analysis, then turn the findings into new detections and process updates
• Write and test playbooks and runbooks (phishing, ransomware, BEC, insider threat, cloud compromise, data exfiltration)
• Run tabletop and purple-team exercises with the internal Red Team
• Report on SOC performance, threat landscape and risk posture to the CISO and senior stakeholders

Required experience

• 4+ years in cybersecurity operations, incident response or security engineering
• Proven experience leading a SOC team, including remote or distributed staff
• Solid understanding of SOC operating models (tiered, hybrid, follow-the-sun)
• Track record of building or significantly improving detection and response capabilities
• Cloud security on AWS (GuardDuty, CloudTrail, Security Hub) and Azure (Defender for Cloud, Entra ID Protection), plus Wiz
• Digital forensics, malware analysis, NIST CSF and NIST 800-61
• Strong communication skills, able to explain technical findings to executives

Nice to have

• Certifications: CISSP, CISM, GCIH, GCIA, GCED, SC-200, AZ-500
• Background in commodity trading, energy or financial services
• Experience with SOAR, Python and PowerShell scripting