Lead SOC Engineer – Detection, Response & Mentorship

Soni; Philadelphia (Philadelphia County); On-site; USD 140,000 - 180,000; Full time

Job summary

Soni is seeking a hands-on SOC Lead to build and mature a Security Operations Center. You will oversee day-to-day SOC operations, strengthen detection and response, and mentor a team of security analysts.

You will develop runbooks and incident response procedures, tune detections, and lead threat hunting across SIEM, EDR, and cloud telemetry, while collaborating with cross-functional teams to improve security maturity.

Qualifications

• 5+ years in Security Operations, Incident Response, or related fields.
• Experience leading a SOC or senior security role with process maturity.
• Hands-on experience building or maturing SOC processes and playbooks.
• Proficiency with SIEM platforms and security automation tooling.

Responsibilities

• Lead daily SOC operations and act as escalation point for complex incidents.
• Develop and maintain SOC runbooks, playbooks, and IR procedures.
• Mentor SOC analysts and establish effective investigation practices.
• Tune SIEM detections and reduce false positives.
• Lead threat hunting across SIEM, EDR, cloud telemetry, threat intel.
• Manage incidents through triage, containment, eradication, recovery, post-incident review.
• Perform root cause analysis and drive remediation efforts.
• Implement automation and SOAR capabilities to scale SOC efficiency.
• Develop SOC metrics and reporting to measure performance and maturity.
• Collaborate with security, IT, and engineering teams to improve operations.

Skills

SOC operations

Incident response

Threat detection

Security automation

Python/PowerShell/Bash

Tools

Microsoft Sentinel

Google SecOps

Splunk

IBM QRadar

CrowdStrike

Microsoft Defender

SentinelOne

Job description

Soni is seeking a hands-on SOC Lead to build and mature a Security Operations Center. You will oversee day-to-day SOC operations, strengthen detection and response, and mentor a team of security analysts.

You will develop runbooks and incident response procedures, tune detections, and lead threat hunting across SIEM, EDR, and cloud telemetry, while collaborating with cross-functional teams to improve security maturity.