Cyber Ops Lead | SOC Lead

Programmers.io; Draper (UT); On-site; USD 120,000 - 160,000; Full time

Job summary

Programmers.io is seeking an experienced Security Operations Center professional to lead daily SOC operations in Draper, UT. The role requires 5+ years in a SOC or cyber defense, with 1-2 years in a lead or senior analyst capacity, and strong skills in incident response, SIEM/EDR, and case management.

You will coordinate cross-functional teams across Tech Operations, IT, and Engineering, including on-call coverage and mentor junior analysts.

Qualifications

• 5+ years in a SOC or cyber defense role, with 1-2 years in lead or senior capacity.
• Experience managing case queues and driving resolution in fast-paced environments.
• Working knowledge of SIEM, EDR, and case/ticket management tooling.
• Strong incident response fundamentals: triage, containment, escalation.
• Excellent cross-functional collaboration with Technology Operations, IT, and Engineering.
• Excellent written and verbal communication; ability to translate technical details for varied audiences.
• On-site in Draper, UT; on-call/shift coverage as needed.

Responsibilities

• Lead day-to-day SOC operations: monitoring, alert triage, and initial incident response.
• Own and manage the SOC case queue; ensure SLAs and timely resolution.
• Coordinate shift coverage and on-call rotations for continuous monitoring.
• Serve as senior escalation point for analysts on complex cases.
• Drive improvements to detection content, runbooks, and SOPs.
• Act as liaison between Cyber Defense and Tech Operations on cross-team issues.
• Support incident response with containment recommendations and cross-team coordination.
• Mentor and develop SOC analysts; support onboarding.
• Track SOC metrics and report trends to leadership.

Skills

SOC leadership

Incident response

Case/ticket management

SIEM / EDR

Cross-functional collaboration

On-site in Draper, UT

Communication

Tools

Case management tooling

Ticketing system

Job description

ROLE_DESCRIPTION

5+ years of experience in a Security Operations Center or similar cyber defense role, including at least 1-2 years in a lead, senior analyst, or shift-lead capacity

Act as the primary liaison between Cyber Defense and Tech Operations on issues that span both teams (eg., system changes, outages, access requests, infrastructure-related findings).

Lead day-to-day SOC operations, including monitoring, alert triage, and initial incident response.

Working knowledge of SIEM, EDR, and case/ticket management tooling"

ESSENTIAL_SKILLS

• 5+ years of experience in a Security Operations Center or similar cyber defense role, including at least 1-2 years in a lead, senior analyst, or shift-lead capacity
• Demonstrated experience managing case/ticket queues and driving them to resolution in a fast-paced environment.
• Working knowledge of SIEM, EDR, and case/ticket management tooling
• Solid understanding of incident response fundamentals (triage, containment, escalation).
• Comfortable working cross-functionally with Technology Operations, IT, and Engineering teams.
• Strong written and verbal communication skills; able to translate technical detail for varied audiences.
• Willingness and ability to work on-site in Draper, UT, including participation in on-call/shift coverage as needed.

SKILLS_REQUIRED

Case & Queue Management

Own the SOC case queue: triage incoming alerts, tickets, and requests; assign priority and ownership; track cases through to resolution.

Maintain SLAs for case handling and escalation; identify and clear bottlenecks before they become backlogs.

Ensure consistent documentation, categorization, and closure quality across all cases.

SOC Leadership & Operations

Lead day-to-day SOC operations, including monitoring, alert triage, and initial incident response.

Coordinate shift coverage and on-call rotations to maintain continuous monitoring.

Serve as a senior escalation point for analysts on complex or ambiguous cases.

Drive continuous improvement Of detection content, playbooks, and standard operating procedures.

Partnering with Technology Operations

Act as the primary liaison between Cyber Defense and Tech Operations on issues that span both teams (eg., system changes, outages, access requests, infrastructure-related findings).

Coordinate response and remediation activities that require Tech Operations involvement, ensuring clear handoffs and shared visibility into status.

Participate in change management and operational reviews where security input is needed.

Incident Response

Support incident response efforts, including initial triage, containment recommendations, and coordination across teams during active incidents.

Contribute to post-incident reviews and help translate lessons learned into process or tooling improvements.

Mentorship & Team Development

Mentor and provide day-to-day guidance to SOC analysts; support onboarding and skills development.

Help set expectations for case quality, communication, and escalation practices.

Reporting & Metrics

Track and report on SOC operational metrics (case volume, time-to-triage, time-to-resolution, escalation rates) to the Director, Cyber Defense & Strategy.

Flag trends or recurring issues that indicate a need for process, tooling, or staffing changes.