SOC Tech Lead: Threat Hunting & Incident Response

Thales Group; Madrid; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Flexible Hybrid Work

Up to 41 vacation days

Friday focus time (monthly)

Flexible compensation package

Annual training & certifications

Speakers Program

Performance-based bonuses

Job summary

Thales S21sec Spain is seeking a SOC Technical Lead for Threat Hunting and Incident Response in Madrid. You will lead proactive defense, guide investigations, and mentor a growing team across hybrid environments.

You will drive a culture of security as code, automation, and continuous improvement while coordinating with cloud and product teams to strengthen the global security ecosystem.

Qualifications

• 2–5 years of experience in Cybersecurity, focusing on Security Operations, Incident Response, or Threat Hunting.
• Demonstrated experience in technical lead or senior advisory role guiding teams through complex challenges.
• Proven background in security operations within high-scale, distributed environments (Cloud or Hybrid).
• Advanced understanding of attacker TTPs and the MITRE ATT&CK framework.
• Deep expertise in SIEM/SOAR platforms, EDR/XDR tools, and network traffic analysis.
• Experience with Cloud security (AWS, Azure, or GCP) and shared responsibility models.
• Experience leading large-scale incident investigations and performing root-cause analysis.
• Familiarity with forensic analysis tools and procedures.

Responsibilities

• Drive Proactive Defense: spearhead threat hunting strategy using telemetry and intelligence to uncover attacker patterns before impact.
• Lead Through Crisis: provide the technical force behind Incident Response, guide the team in high-pressure situations and refine the playbook.
• Mentor and Innovate: mentor teammates, run technical workshops, and foster continuous improvement and excellence.
• Architect the Future: partner with cloud/product teams to embed security into lifecycle with Security-as-Code and automation.

Skills

Threat Hunting

Incident Response

Security Leadership

Forensics

MITRE ATT&CK

Team Mentoring

Tools

SIEM/SOAR

EDR/XDR

Network Traffic Analysis

Cloud Security (AWS/Azure/GCP)

Job description

Thales S21sec Spain is seeking a SOC Technical Lead for Threat Hunting and Incident Response in Madrid. You will lead proactive defense, guide investigations, and mentor a growing team across hybrid environments.

You will drive a culture of security as code, automation, and continuous improvement while coordinating with cloud and product teams to strengthen the global security ecosystem.