SecOps Command Center Lead

TESTQ Technologies LTD.; United Kingdom; Hybrid; GBP 90,000 - 120,000; Full time

Job summary

TESTQ Technologies LTD. is seeking a SecOps Command Center Lead to oversee a 24x7 security operations center in a hybrid setup (3 days in the office).

The role combines leadership of a shift-based team with hands-on monitoring, triage, and escalation across endpoints, networks and identity tools. Qualifications include 10+ years in SOC, strong English communication, and a preference for GSEC or equivalent certifications.

Qualifications

• At least 10+ years in 24x7 SOC environments.
• Experience leading or supervising a shift-based security monitoring team.
• Strong knowledge of cybersecurity fundamentals.
• Proficient in security alert triage and escalation across endpoints, networks and identity tools.
• Experience with SLA/KPI reporting and RCA facilitation.
• Clear written and spoken English, including leadership reporting.

Responsibilities

• Lead the SecOps Command Center across shifts, manage rosters and handovers.
• Own shift schedule to ensure 24x7 coverage with no gaps.
• Coach analysts on triage quality, tool use and SOP adherence.
• Review shift performance: alerts, response times, and missed alerts.
• Escalate incidents with evidence and recommended actions to client security teams.
• Keep ServiceNow tickets updated and closed with clear notes/logs.
• Produce daily/weekly SecOps status reports for leadership and stakeholders.
• Maintain SOPs, escalation matrices, and knowledge-base articles.

Skills

Leadership

Shift scheduling

Security monitoring

Incident escalation

SOP adherence

English communication

Education

GSEC or equivalent SOC cert

Tools

Splunk

Jamf

ServiceNow

Job description

TQINE0088_6045 - SecOps Command Center Lead

Job Type: Contract,Permanent

Work Mode: Hybrid (3 Days from office)

Domain

SecOps Command Center (L1)

Scope

24x7 Security Monitoring, Alert Triage, Escalation & Shift Leadership

Lead and manage the L1 SecOps Command Center. Ensure consistent security monitoring, triage and escalation across shifts, while supervising the on-floor analyst team.

Process

Command Center Leadership

• Supervise the SecOps Command Center analysts across shifts, including rosters and shift handover.
• Own the shift schedule and make sure 24x7 security monitoring coverage has no gaps.
• Coach analysts on triage quality, tool use and SOP adherence.
• Review shift performance: alert volume, response times and missed alerts.
• Stakeholder Management, collaboration with different teams and attend the MIM meetings in case of P1/P2 incidents
• Be the point of escalation when an analyst cannot resolve or classify a security alert.

Monitoring and Triage

• Oversee continuous monitoring of security alerts across endpoint, network, DLP and identity tools. Analyze the alerts to reduce duplicate alerts/noise suppression and optimize the alerts.
• Confirm alerts are triaged, enriched and routed to the correct Application/MIM/Infra/L2 security tower within the target time if not resolved on the SOPs/Runbooks.
• Check service and endpoint availability monitoring, including agent health and coverage.
• Confirm ServiceNow tickets are raised, updated and closed with clear notes/logs.
• Escalate confirmed security incidents to the client's security team promptly, with evidence and recommended action.

Reporting and Improvement

• Produce and review the daily and weekly SecOps Command Center status report for leadership.
• Assist MIM to Run RCA and post-incident reviews for major or repeated security incidents.
• Keep SOPs, escalation matrices and knowledge-base articles current.
• Track and report on SLA and KPI performance for the Command Center.

Common

• Keep ServiceNow tickets and dashboards current, with clear resolution and closure notes.
• Work with DLP, Malware Tools, Network Security and IDAM leads on process and tooling changes.

Tools

• SIEM or security monitoring platform (Splunk)
• Endpoint (Jamf) and network security consoles (read access)
• Dashboarding and reporting tools
• Shift roster and workforce management tools

Technologies

• Windows Bit Locker for Laptop and basic knowledge of Network Security, IDAM, Malware & DLP
• Endpoint and service availability monitoring
• ITSM incident, problem and change processes
• Shift and workforce management
• SLA and KPI reporting
• RCA and continuous improvement

Experience

• 10+ Years of experience in a 24x7 Security Operations Center environment
• Experience leading or supervising a shift-based security monitoring team
• Knowledge of cybersecurity fundamentals.
• Security alert triage and escalation across endpoint, network and identity tools
• SLA/KPI reporting and RCA facilitation
• Clear written and spoken English, including leadership reporting

Peferred Certifications

• GIAC Security Essentials (GSEC) or equivalent SOC certification