SOC Lead

Training Basket; Dadri; On-site; INR 1,400,000 - 2,200,000; Full time

Job summary

Training Basket is seeking a seasoned SOC Lead to manage a team of L1–L3 analysts, oversee 24/7 operations, and coordinate incident response across IT, networking, and cloud environments.

You will drive detection improvements, conduct threat hunting, perform RCA on major incidents, ensure SLAs are met, mentor junior analysts, and support security audits.

This role requires strong communication, leadership, and hands-on security experience in a fast-paced, regulated environment.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field.
• 5–8 years of experience in cybersecurity or SOC operations.
• Hands-on with SIEM tools: Splunk, QRadar, Sentinel, ArcSight.
• Experience with EDR/XDR: CrowdStrike, Defender, SentinelOne.
• Knowledge of networks, firewalls, IDS/IPS, VPNs, and endpoint security.
• Familiarity with MITRE ATT&CK and kill chain.
• Understanding of TCP/IP, DNS, HTTP/HTTPS and network protocols.
• Experience with vulnerability tools: Nessus, Qualys, Rapid7.
• Experience with threat intelligence platforms and security automation.
• Strong analytical, troubleshooting, leadership, and communication skills.

Responsibilities

• Lead and manage a team of SOC analysts (L1–L3).
• Monitor security alerts and incidents using SIEM platforms.
• Manage incident detection, investigation, escalation, containment, and remediation.
• Oversee 24/7 SOC operations, shift schedules, and escalation processes.
• Conduct threat hunting and analyze suspicious network activities.
• Develop and maintain incident response procedures, playbooks, and SOPs.
• Ensure timely resolution of security incidents according to SLAs.
• Perform root cause analysis (RCA) for major security incidents.
• Coordinate with IT, networking, cloud, and infrastructure teams to resolve threats.
• Improve detection rules, alert correlation, and SOC monitoring capabilities.
• Prepare daily, weekly, and monthly SOC performance reports.
• Conduct security awareness sessions and mentor junior SOC analysts.
• Support compliance activities and security audits.
• Stay updated on emerging cyber threats and attack techniques.

Skills

Team leadership

SOC operations

Threat hunting

Incident response

SIEM proficiency

Analytical skills

Communication

Mentoring

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Splunk

IBM QRadar

Microsoft Sentinel

ArcSight

CrowdStrike

Microsoft Defender

SentinelOne

Nessus

Qualys

Rapid7

Job description

Lead and manage a team of SOC L1, L2, and L3 security analysts.

Monitor security alerts, events, and incidents using SIEM platforms.

Manage incident detection, investigation, escalation, containment, and remediation.

Oversee 24/7 SOC operations, shift schedules, and incident escalation processes.

Conduct threat hunting and analyze suspicious network activities.

Develop and maintain incident response procedures, playbooks, and SOPs.

Ensure timely resolution of security incidents according to defined SLAs.

Perform root cause analysis (RCA) for major security incidents.

Coordinate with IT, networking, cloud, and infrastructure teams to resolve security threats.

Improve detection rules, alert correlation, and SOC monitoring capabilities.

Prepare daily, weekly, and monthly SOC performance reports.

Conduct security awareness sessions and mentor junior SOC analysts.

Support compliance activities and security audits.

Stay updated on emerging cyber threats, vulnerabilities, and attack techniques.

Requirements

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.

5–8 years of experience in cybersecurity or SOC operations, including team leadership experience.

Strong hands‑on experience with SIEM tools such as Splunk, IBM QRadar, Microsoft Sentinel, or ArcSight.

Knowledge of EDR/XDR solutions such as CrowdStrike, Microsoft Defender, or SentinelOne.

Strong understanding of network security, firewalls, IDS/IPS, VPNs, and endpoint security.

Experience in security incident handling, malware analysis, and threat investigation.

Familiarity with the MITRE ATT&CK framework and cyber kill chain.

Understanding of TCP/IP, DNS, HTTP/HTTPS, and network protocols.

Knowledge of vulnerability assessment and management tools such as Nessus, Qualys, or Rapid7.

Experience with threat intelligence platforms and security automation tools.

Strong analytical, troubleshooting, communication, and leadership skills.