Lead SOC Analyst

deepwatchinc; United States; Hybrid; USD 110,000 - 160,000; Full time

Benefits offered by this job

Medical, dental, vision

Disability coverage

Flexible time off

Retirement plan

Professional development funding

Job summary

Deepwatchinc seeks an experienced Security Operations Lead to manage day-to-day incident triage and investigations from a home office or hybrid Tampa site. You will guide analysts through complex threats, escalate as needed, and ensure timely, thorough reporting across customer environments.

The role blends hands-on analysis with coaching, process improvement, and close collaboration with threat response, security response, and product teams.

Qualifications

• 5+ years of security operations experience.
• Strong cybersecurity knowledge; advise on complex escalations.
• Ability to communicate investigation findings and guide response decisions.
• Eligibility as a U.S. person under applicable export-control rules.
• Ability to work from a home office when remote and pass a pre-employment background check.

Responsibilities

• Lead analysts through complex investigations, including effective SIEM analysis.
• Serve as the shift's escalation point and determine next steps for critical investigations.
• Take ownership of high-complexity customer incidents and ensure timely reporting.
• Coordinate with threat response resources when an incident requires additional support.
• Coach analysts and participate in peer review of escalated analysis.
• Contribute to operational improvement projects with leadership and product teams.

Skills

Security operations

Incident response

Threat analysis

Communication

U.S. person eligibility

Job description

Role overview

Lead day-to-day security operations for a shift, helping analysts investigate complex threats and protect customer environments. The role combines hands-on incident triage and escalation with coaching, quality improvement, and coordination across security response and customer-facing teams.

Responsibilities

• Guide analysts through complex investigations, including effective SIEM analysis and established security practices.
• Serve as the shift's escalation point and determine next steps for critical investigations, suspected compromises, and network targeting.
• Take ownership of high-complexity customer incidents and help ensure timely, thorough reporting.
• Coordinate with threat response resources when an incident or compromise requires additional support.
• Coach analysts, support security learning, and participate in peer review of escalated analysis.
• Contribute to operational improvement projects, procedures, and customer experience in partnership with leadership and product teams.

Requirements

• At least five years of security operations experience.
• Strong cybersecurity knowledge and the ability to advise on complex escalations.
• Ability to communicate investigation findings and guide analysts through response decisions.
• Eligibility as a U.S. person under applicable export-control rules, such as U.S. citizenship, permanent residency, refugee status, or asylum status.
• Ability to work from a home office when remote and pass a pre-employment background check.

Benefits and work setup

The schedule is Monday through Friday, 6 a.m. to 2 p.m. Eastern. The role can be fully remote within the United States or hybrid in Tampa, with three office days and two remote days per week.

• medical, dental, vision, and disability coverage
• flexible time off, holidays, sick leave, and paid parental leave
• a retirement plan
• annual professional development funding