Soc Lead

eSec Forte Technologies; Gurugram District; On-site; INR 3,500,000 - 5,500,000; Full time

Benefits offered by this job

Health insurance

Learning & skill-development allowance

Conference/training attendance

Flexible work arrangements

Security certification reimbursement

Job summary

eSec Forte is seeking an experienced SOC Leader to drive 24x7 security operations for managed services clients from our Gurugram office. You will oversee incident response, threat hunting, and triage with a focus on robust alerting and fast containment.

You will mentor junior SOC analysts, tune SIEM/EDR deployments (Splunk, Sentinel, Elastic SIEM, CrowdStrike, SentinelOne) and develop SOAR playbooks to automate response. Strong client communication is essential during incidents.

Qualifications

• 8–10 years in SOC with leadership or senior capacity.
• Expertise operating SIEM platforms (Splunk, Sentinel, Elastic SIEM) with advanced querying, dashboards and tuning.
• EDR solutions experience (CrowdStrike, SentinelOne, Defender for Endpoint) including incident response.
• Strong understanding of TTPs and applying threat intel to detection/hunting.
• Experience developing SOAR playbooks to accelerate incident response workflows.
• Strong analytical skills for incident analysis and root-cause identification.

Responsibilities

• Lead investigations and containment for security incidents following IR procedures.
• Manage detection engineering and tuning across SIEM platforms to reduce false positives.
• Architect and optimize monitoring solutions across cloud and on-prem environments.
• Mentor and develop SOC analysts in threat analysis, incident handling and forensics.
• Develop advanced threat hunting strategies to identify sophisticated threats.
• Drive SOAR playbook development to automate incident response.
• Serve as escalation point during critical incidents with strategic direction.
• Collaborate with clients to tailor SOC services to their risk posture and reporting needs.

Skills

SOC leadership

SIEM management

EDR expertise

Threat intelligence

SOAR playbooks

Incident analysis

Client communication

Tools

Splunk

Microsoft Sentinel

Elastic SIEM

CrowdStrike

SentinelOne

Defender for Endpoint

Job description

About the Role

This role involves leading 24x7 Security Operations Center (SOC) engagements, overseeing alert triage, incident response, and threat hunting for managed services clients. You will drive architectural and methodology decisions for security monitoring solutions and play a critical role in mentoring and developing junior SOC analysts. The work requires disciplined escalation management and clear client communication during active security incidents.

Key Responsibilities

• Lead the investigation and containment efforts for confirmed security incidents, leveraging EDR solutions such as CrowdStrike or SentinelOne, and ensuring adherence to established incident response procedures.
• Manage detection engineering and tuning across SIEM platforms like Splunk, Microsoft Sentinel, or Elastic SIEM to reduce false positives and enhance threat visibility for client environments.
• Architect and optimize security monitoring solutions, integrating various data sources from cloud-native environments and on-premise infrastructure to build comprehensive threat detection capabilities.
• Mentor and guide a team of SOC analysts, fostering their technical growth in areas like threat analysis, incident handling, and forensic investigation techniques.
• Develop and implement advanced threat hunting strategies, proactively identifying sophisticated threats that evade automated detections within client networks.
• Drive the development and refinement of SOAR playbooks to enhance automation and efficiency in incident response workflows and reduce manual effort.
• Serve as a primary escalation point for complex security incidents, providing expert guidance and strategic direction during critical events to ensure timely resolution.
• Collaborate with clients to understand their security posture and tailor SOC services, ensuring alignment with their risk management objectives and reporting requirements.

Requirements

• 8-10 years of experience in Security Operations Center (SOC) environments, with a significant portion in a leadership or senior capacity.
• Proven expertise in managing and operating SIEM platforms such as Splunk, Microsoft Sentinel, or Elastic SIEM, including advanced query writing, dashboard creation, and rule tuning.
• Demonstrable experience with Endpoint Detection and Response (EDR) solutions like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint, including incident investigation and response.
• Solid understanding of common attack techniques, tactics, and procedures (TTPs) and experience applying threat intelligence to detection and hunting activities.
• Experience in developing and implementing Security Orchestration, Automation, and Response (SOAR) playbooks to streamline incident response.
• Strong analytical skills for incident analysis, root cause identification, and security posture assessment.
• Excellent communication skills, both written and verbal, for technical reporting and client interaction during critical incidents.
• Ability to work in an onsite capacity from our Gurugram office.

Nice-to-Have

• Experience with cloud security monitoring and incident response in environments like AWS, Azure, or GCP.
• Familiarity with network security tools from vendors such as Palo Alto Networks or Zscaler.
• Proficiency in scripting languages (e.g., Python, PowerShell) for automation and data analysis.
• Relevant industry certifications such as GIAC Certified Incident Handler (GCIH) or GIAC Certified Forensic Analyst (GCFA).

Benefits

• Health insurance for the employee and dependents
• Professional security-certification reimbursement (e.g., for GCIH, GCFA)
• Annual learning and skill-development allowance
• Sponsored conference / training attendance
• Flexible work arrangements