Cyber Ops Lead I SOC Lead

SFE; Utah; Presencial; USD 120 000 - 170 000; Tempo integral

Resumo da oferta

SFE in Draper, Utah, is seeking a Cyber Ops Lead to head SOC operations and incident response on-site. You will triage alerts, drive case resolution, and lead the SOC team with a focus on improving playbooks and processes.

Ideal candidates have 5+ years in a security operations setting, strong cross-functional communication, and hands-on experience with SIEM/EDR tools, incident response, and escalation paths. On-site presence is required.

Qualificações

• 5+ years in a Security Operations Center or similar cyber defense role, with 1–2 years in lead capacity.
• Experience managing case/ticket queues and driving resolution in a fast-paced environment.
• Working knowledge of SIEM, EDR, and case/ticket management tooling.
• Solid understanding of incident response fundamentals (triage, containment, escalation).
• Strong written and verbal communication; able to convey technical details to varied audiences.
• Willingness to work on-site in Draper, UT, including on-call rotations.

Responsabilidades

• Own the SOC queue: triage alerts, assign priority, track cases to resolution.
• Maintain case SLAs and identify bottlenecks to prevent backlogs.
• Ensure consistent documentation and closure quality across all cases.
• Lead day-to-day SOC operations: monitoring, alert triage, initial response.
• Coordinate shift coverage and on-call rotations for continuous monitoring.
• Serve as senior escalation point for complex cases and improve detection content.
• Partner with Technology Operations on cross-team issues and changes.
• Participate in change management and operational reviews with security input.
• Support incident response, including containment guidance and cross-team coordination.
• Mentor SOC analysts and support onboarding and skills development.
• Track and report SOC metrics to leadership and flag trends needing action.

Conhecimentos

5+ years in SOC

Lead / senior analyst experience

Queue/case management

Cross-functional collaboration

Strong written/verbal communication

On-site in Draper, UT

Ferramentas

SIEM

EDR

Ticketing tools

Descrição da oferta de emprego

Role Cyber Ops Lead I SOC Lead

Location Draper, Utah (Onsite)

Fulltime

Job Description

Must Have Technical/Functional Skills

• Experience in a regulated industry (healthcare, financial services, or similar) handling sensitive data.
• Relevant certifications such as GCIH, GCIA, Security+, CySA+, or equivalent.
• Familiarity with cloud environments (AWS, Azure) and common cloud security tooling.
• Prior experience building or refining SOC playbooks, runbooks, or standard operating procedures.
• SOC case queue is triaged consistently with clear ownership and no unexplained aging
• Escalation paths to Tech Operations are documented and running smoothly, with fewer dropped handoffs.
• Analyst team has clear expectations, regular feedback, and improving case quality.
• Director, Cyber D fense & Strategy has reliable visibility into SOC health through regular reporting

Roles & Responsibilities

Key Responsibilities

Case & Queue Management

• Own the SOC case queue: triage incoming alerts, tickets, and requests; assign priority and ownership; track cases through to resolution.
• Maintain SLAs for case handling and escalation; identify and clear bottlenecks before they become backlogs.
• Ensure consistent documentation, categorization, and closure quality across all cases.

SOC Leadership & Operations

• Lead day-to-day SOC operations, including monitoring, alert triage, and initial incident response.
• Coordinate shift coverage and on-call rotations to maintain continuous monitoring.
• Serve as a senior escalation point for analysts on complex or ambiguous cases.
• Drive continuous improvement Of detection content, playbooks, and standard operating procedures.
• Partnering with Technology Operations
• Act as the primary liaison between Cyber Defense and Tech Operations on issues that span both teams (eg., system changes, outages, access requests, infrastructure-related findings).
• Coordinate response and remediation activities that require Tech Operations involvement, ensuring clear handoffs and shared visibility into status.
• Participate in change management and operational reviews where security input is needed.

Incident Response

• Support incident response efforts, including initial triage, containment recommendations, and coordination across teams during active incidents.
• Contribute to post-incident reviews and help translate lessons learned into process or tooling improvements.

Mentorship & Team Development

• Mentor and provide day-to-day guidance to SOC analysts; support onboarding and skills development.
• Help set expectations for case quality, communication, and escalation practices.

Reporting & Metrics

• Track and report on SOC operational metrics (case volume, time-to-triage, time-to-resolution, escalation rates) to the Director, Cyber Defense & Strategy.
• Flag trends or recurring issues that indicate a need for process, tooling, or staffing changes.

Required Qualifications

• 5+ years of experience in a Security Operations Center or similar cyber defense role, including at least 1-2 years in a lead, senior analyst, or shift-lead capacity
• Demonstrated experience managing case/ticket queues and driving them to resolution in a fast-paced environment.
• Working knowledge of SIEM, EDR, and case/ticket management tooling
• Solid understanding of incident response fundamentals (triage, containment, escalation).
• Comfortable working cross-functionally with Technology Operations, IT, and Engineering teams.
• Strong written and verbal communication skills; able to translate technical detail for varied audiences.
• Willingness and ability to work on-site in Draper, UT, including participation in on-call/shift coverage as needed.