AI SOC Lead

EthicalHat Cyber Security Pvt. Ltd.; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

EthicalHat Cyber Security Pvt. Ltd. is seeking a SOC Lead to manage day-to-day security operations, coordinate analysts, and act as escalation point for complex incidents. You will oversee AI-assisted alert enrichment, ensure responsible automation, and safeguard human judgment.

You will review AI-assisted triage, mentor L1/L2 analysts, and coordinate with clients during incidents and post-incident reviews. Strong English communication is essential.

Qualifications

• 6+ years in information security with at least 3 years in SOC or incident response.
• Hands-on experience with a major SIEM and an EDR/XDR platform.
• Excellent English communication for client interactions and reporting.

Responsibilities

• Prioritize the alert queue, assign work, and meet client service commitments.
• Lead complex incident response from triage to containment and handover.
• Review AI-assisted triage and investigation findings for accuracy.
• Tune SIEM/XDR detections and AI prompts to reduce false positives.
• Conduct threat hunts using current intel and MITRE ATT&CK techniques.
• Coach analysts, manage shift handovers, and review investigations.

Skills

SOC leadership and mentoring

Incident response

Client communication

Security operations management

Tools

SIEM

EDR/XDR

Job description

Role overview

Lead day-to-day operations for a security operations shift, coordinating analysts and serving as the escalation point for complex incidents. The SOC uses AI agents to enrich alerts and support investigations; you will review their work and ensure automation is applied with appropriate human judgment and safeguards.

Responsibilities

• Prioritize the alert queue, assign work, and keep client service commitments on track.
• Lead complex incident response from initial triage through containment and handover.
• Review AI-assisted triage and investigation findings, correcting inaccurate conclusions.
• Tune SIEM and XDR detections, suppression rules, and AI prompts to reduce false positives.
• Conduct threat hunts informed by current intelligence and MITRE ATT&CK techniques.
• Coach L1 and L2 analysts, manage shift handovers, and review investigation quality.
• Maintain playbooks and runbooks, including controls and approval steps for automated actions.
• Communicate with client stakeholders during incidents and contribute to post-incident reviews.

Requirements

• 6+ years in information security, including at least 3 years in SOC or incident response work.
• Hands-on experience with a major SIEM and an EDR or XDR platform.
• Strong knowledge of Windows, Linux, TCP/IP, DNS, HTTP, and cloud logs from AWS, Azure, or GCP.
• Incident handling experience spanning detection, containment, and root-cause analysis.
• Practical familiarity with LLM tools in security workflows and their limitations.
• Experience leading or mentoring analysts in a 24×7 environment.
• Excellent spoken and written English for client communication.