Get more replies from employers
Send a job-specific resume in minutes.
The SOC Program Lead will build, run, and continuously improve a customer-focused Managed SOC service. This role combines hands-on security operations with team leadership, tooling ownership, and customer engagement. The individual will ensure security alerts are handled efficiently, processes are followed consistently, and customers receive clear, actionable communication. This position plays a critical role in delivering reliable, scalable security operations across multiple client environments.
Responsibilities
Lead the day-to-day operation of the Managed SOC program
Deploy, configure, and maintain SOC tooling across customer environments
Define and enforce SOC processes, workflows, and escalation procedures
Train, mentor, and oversee SOC analysts
Ensure alerts are properly triaged, investigated, and responded to
Tune detections to reduce false positives and improve signal quality
Act as the primary security point of contact for customers
Communicate incidents clearly to customers in non-technical terms
Ensure proper documentation, reporting, and incident records
Support audits, compliance requests, and security reviews
Continuously improve SOC operations, tooling usage, and analyst performance
4–7+ years of experience in a SOC, MSSP, or security operations role
Strong hands-on experience with security monitoring and response
Solid understanding of:
Endpoint security (EDR)
Identity and access monitoring
Email and phishing threats
Cloud security fundamentals
Experience deploying and managing security tools for multiple customers
Prior experience leading or mentoring junior analysts
Comfortable making decisions and escalating incidents when needed
Strong written and verbal communication skills
Customer-focused mindset with the ability to explain security clearly
Able to work independently and take ownership of outcomes
Experience in a managed services or MSSP environment
Familiarity with security frameworks (NIST, CIS, ISO)
Experience working with international customers
Exposure to SOC automation or SOAR workflows