SOC Team Lead: Incident Response & Operations Champion

NTT Limited; United Kingdom; Remote; GBP 70,000 - 90,000; Full time

Job summary

NTT DATA is seeking a Security Operations Team Lead to run the SOC, mentor analysts, and ensure high-quality service delivery to clients. You will manage incidents, coordinate with technical teams, and maintain playbooks and metrics.

You will drive improvements, oversee 24/7 coverage (where applicable), and contribute to client reports and dashboards while staying aligned with security frameworks and compliance requirements.

Qualifications

• 5+ years in a Security Operations Centre or related security environment.
• At least 2 years in a team lead or supervisory role.
• Experience with incident detection, escalation, and resolution processes.
• Experience with SIEM, IDS/IPS, endpoint protection, and threat intel platforms.
• Strong verbal and written communication; attention to detail and quality.

Responsibilities

• Oversee SOC operations and delivery of managed security services to clients.
• Monitor performance against SLAs and KPIs to ensure quality.
• Implement incident management procedures and threat monitoring playbooks.
• Escalate client concerns and coordinate with technical teams.
• Lead and mentor SOC analysts, schedule 24/7 coverage.
• Drive automation and process improvements to boost MTTD/MTTR.

Skills

Security operations management

Incident detection & response

Team leadership

Communication skills

SIEM/IDS/IPS experience

Threat intelligence platforms

Education

Security certifications (e.g., CompTIA Security+, GCIH, SSCP, CEH)

Tools

SIEM

IDS/IPS

Endpoint protection

Threat intelligence platforms

Job description

NTT DATA is seeking a Security Operations Team Lead to run the SOC, mentor analysts, and ensure high-quality service delivery to clients. You will manage incidents, coordinate with technical teams, and maintain playbooks and metrics.

You will drive improvements, oversee 24/7 coverage (where applicable), and contribute to client reports and dashboards while staying aligned with security frameworks and compliance requirements.