SOC Lead

UBQ.io; Spain; Remote; EUR 90,000 - 130,000; Full time

Job summary

UBQ.io is seeking an experienced SOC Lead to run our global follow-the-sun Security Operations Center. You will lead a distributed team of SOC Analysts, manage scheduling across time zones, and own incident response processes to deliver rapid, high-quality investigations.

You will triage, investigate, and hunt threats across SIEM, EDR, SSE, and WAF platforms, while driving improvements to detection content and governance. Excellent English communication is essential for remote collaboration.

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (or equivalent practical experience).
• At least 5 years of hands-on Security Operations experience, including at least 1 year as a SOC Lead or similar lead role.
• Proven experience triaging alerts, investigating incidents, and leading major incident responses in production.
• Solid knowledge of EDR, SSE, SIEM, and WAF technologies and how to use them to investigate threats.
• Experience leading or working in a 24/7 follow-the-sun SOC with distributed teams across time zones.
• Strong incident response and threat hunting capabilities, familiarity with MITRE ATT&CK.
• Excellent written and verbal English communication, stakeholder reporting.

Responsibilities

• Lead and coach a distributed SOC Analysts team across regions.
• Own the SOC schedule and rotations, including weekend coverage.
• Define and enforce the shift handover process for continuous investigations.
• Act as escalation point and incident lead for major security incidents.
• Triage, investigate, and hunt threats across SIEM, EDR, SSE, and WAF.
• Review investigation quality and improve documentation and standards.
• Define, track, and report SOC KPIs (alerts, MTTD, MTTR, false positives).
• Improve detection content with engineering and tune SIEM/EDR/WAF rules.
• Develop and maintain runbooks, playbooks, and escalation matrices.
• Support hiring, onboarding, and training of SOC analysts.
• Collaborate with IT, infra, app, and security engineering to resolve incidents.
• Contribute to vulnerability management and overall security posture.

Skills

SOC leadership

Incident response

Threat hunting

Team management

Security incident handling

English communication

Education

Bachelor's degree in IT/Cybersecurity/CS

Tools

SIEM

EDR

SSE

WAF

Job description

UBQ.io is a global technology service provider dedicated to building a more sustainable, independent, and equitable future. We partner with global companies across industries, including AI, blockchain, software, biotech, and education, to transform bold ideas into real, meaningful solutions.

Our expertise spans technology consulting, AI and Machine Learning development, Blockchain integration, and global team collaboration. With a worldwide network of specialists, we help organizations stay ahead in a rapidly evolving digital landscape.

At UBQ.io, we don’t just advise, we collaborate. Our commitment to innovation, sustainability, and social responsibility guides everything we do as we help clients build technologies that empower people, communities, and industries to thrive.

About the role

The SOC Lead is responsible for leading the day-to-day operations of the organization's global follow-the-sun Security Operations Center, ensuring that security events are monitored, investigated, and responded to effectively around the clock. Based in Europe and covering the 08:00‑17:00 UTC shift, the SOC Lead manages a distributed team of SOC Analysts across multiple regions and time zones. The role goes beyond supervising a queue: the focus is on setting operational standards, owning the incident response process, driving the quality of investigations and handovers, and continuously improving detection and response capabilities. The ideal candidate combines strong hands‑on SOC experience with proven leadership, and thrives in a fast‑paced, fully remote setting where accuracy, discipline, and security are essential. Hands‑on engineering experience with core security platforms is a big plus.

Key Responsibilities

• Lead, coach, and develop a distributed team of SOC Analysts working across multiple regions in a follow-the-sun model.
• Own the SOC schedule and shift rotations, including weekend coverage, ensuring continuous coverage across all time zones.
• Define and enforce the shift handover process, so that open investigations, ongoing incidents, and pending actions continue seamlessly around the clock.
• Act as the primary escalation point for the team and as incident lead for major security incidents, coordinating triage, analysis, containment, eradication, recovery, and post-incident reviews with relevant teams.
• Perform hands‑on triage, investigation, and threat hunting alongside the team across the security stack, including SIEM, Endpoint Detection and Response (EDR), Security Service Edge (SSE), and Web Application Firewall (WAF) platforms.
• Review the quality of investigations and incident documentation, providing structured feedback and ensuring consistent standards across shifts and regions.
• Define, track, and report SOC metrics and KPIs, such as alert volumes, mean time to detect, mean time to respond, and false positive rates.
• Drive the improvement of detection content together with security engineering, prioritizing the tuning of SIEM correlation rules, EDR custom detections, and WAF rules, and mapping coverage to frameworks such as MITRE ATT&CK.
• Develop and maintain technical documentation, standard operating procedures, incident response playbooks, and escalation matrices.
• Contribute to the hiring, onboarding, and training of new SOC Analysts.
• Collaborate with IT, infrastructure, application, and security engineering teams, as well as management, to resolve incidents and support day-to-day operations.
• Support vulnerability management and drive continuous improvement of the organization’s overall security posture.

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (or equivalent practical experience).
• At least 5 years of hands‑on experience in Security Operations, including at least 1 year as a SOC Lead or in an equivalent team lead role.
• Proven experience triaging alerts, investigating security incidents, and leading the response to major incidents in a production environment.
• Solid working knowledge of core security technologies such as EDR, SSE, SIEM, and WAF, and of how to use them to investigate and respond to threats.
• Hands‑on experience implementing, configuring, and tuning these platforms, or writing and tuning detection content, is a big plus.
• Experience leading or working in a 24/7 or follow-the-sun SOC, including managing shift schedules and remote teams across time zones.
• Strong experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework.
• Excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles.
• Relevant certifications such as Security+, CySA+, GCIA, GCIH, GSOM, CISSP, or vendor‑specific credentials are a plus.
• Strong leadership, analytical, troubleshooting, and problem‑solving skills with a high attention to detail.
• Ability to handle sensitive information responsibly and securely.
• Excellent written and verbal communication skills in English, including the ability to report to management and communicate clearly with technical and non‑technical stakeholders during incidents.

About You

You are an experienced SOC practitioner who has moved into leadership without losing your hands‑on edge. You know what good triage and investigation look like, and you know how to build a team that delivers them consistently across shifts and time zones. You stay calm during major incidents, communicate clearly with both engineers and management, and make sound decisions under pressure. If you have also stood up or tuned the tools your team relies on, or written your own detections, even better. You are structured, reliable, and comfortable leading a fully remote team, and you enjoy coaching analysts, improving processes, and raising the security bar across the environment.