Cyber Triage & Forensics Shift Lead — SOC Leader

Ernst & Young Oman; Alpharetta (GA); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Total Rewards package

Paid time off

Job summary

EY’s Information Security team seeks a CTF Shift Lead to oversee Cyber Triage operations, mentor senior and junior analysts, and ensure rapid threat detection and response. This role supports EY’s global security program and collaborates with leadership to strengthen defenses across the organization.

You will lead day-to-day operations, set performance expectations, and coordinate with the Technical Lead to resolve incidents, while contributing to SOP updates and ongoing process improvements.

Qualifications

• Bachelor's degree in CS/IS/Info Security or equivalent work experience (3-4 years).
• 4–5 years of experience in a Security Monitoring/SOC environment.
• Understanding of electronic investigation and log correlation with proficiency in the latest intrusion detection platforms.
• Working knowledge of Linux and/or Windows systems administration, including Active Directory.
• Scripting or programming skills (Shell scripting, Python, PowerShell, Perl, Java, etc.).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt and efficient response to email and case queues.
• Distribute workload among the threat hunting team and oversee their activities.
• Participate in the analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team performance.
• Report case status and significant incident updates to the global lead.
• Update Standard Operating Procedures (SOPs) and drive continuous improvement within the team.
• Coordinate with the Technical Lead for incident and investigation support as needed.

Skills

SOC experience

Team leadership

Threat detection

Scripting

Linux/Windows

Education

Bachelor's degree in Computer Science, Information Security, or equivalent

Tools

Active Directory

Linux

Windows

Intrusion detection platforms

Job description

EY’s Information Security team seeks a CTF Shift Lead to oversee Cyber Triage operations, mentor senior and junior analysts, and ensure rapid threat detection and response. This role supports EY’s global security program and collaborates with leadership to strengthen defenses across the organization.

You will lead day-to-day operations, set performance expectations, and coordinate with the Technical Lead to resolve incidents, while contributing to SOP updates and ongoing process improvements.