Lead SOC Engineer: Incident Response & Threat Hunting

Lyra Technology Group; Brentwood (TN); Hybrid; USD 90.000 - 95.000; Vollzeit

Zusammenfassung

ImageQuest, part of Lyra Technology Group, seeks a Lead SOC Engineer to act as the technical backbone of our SOC, based in Brentwood, TN. The role emphasizes escalations, incident response, tooling ownership, threat hunting, and automation within a managed services environment.

The ideal candidate has 3+ years in IT security with incident response or threat hunting, strong scripting and networking knowledge, and familiarity with Defender, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf.

Qualifikationen

• 3+ years of proven IT security experience, with hands-on incident response or threat hunting.
• Bachelor's degree in computer science, information technology, or a related field.
• Deep working knowledge of SentinelOne, ThreatLocker, Huntress, and Arctic Wolf, or comparable EDR, SIEM, and MDR platforms.
• Working knowledge of a scripting language (PowerShell) for automation and tooling improvements.
• Thorough understanding of networks (IP subnetting, TCP/IP, routing, VPN) and common attack vectors.
• Familiarity with regulatory frameworks and guidance (NIST, CIS Controls, ISO 27002).

Aufgaben

• Own escalations and confirmed compromises referred from the SOC Analysts.
• Investigate and triage escalated alerts to determine severity, scope, and whether a compromise is confirmed.
• Contain and resolve security incidents before they affect client operations.
• Coordinate with clients to explain containment and investigation under time constraints.
• Serve as backup to SOC Analysts in inbound alerts.
• Conduct post-incident debriefs with the Cybersecurity Advisory team.
• Conduct proactive threat hunting across the client base.
• Maintain current understanding of threat landscape relevant to client industries.
• Serve as escalation point for Defender for Office, IronScales, and Mimecast configuration and tuning.
• Own escalated phishing investigations and adjust spam policy as needed.
• Coordinate with clients on high-impact phishing incidents requiring same-day action.
• Configure and maintain Defender for Endpoint, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf.
• Build deeper, custom ThreatLocker policy; tune detection rules to reduce noise.
• Investigate tooling gaps and false positives.
• Drive scripting and automation improvements across SOC tools; maintain documentation.
• Pull monthly reports and categorize SOC activity.
• Support onboarding of new clients; provide expertise during incidents, audits, and claims.
• Participate in cyber incident tabletop exercises as needed.
• Ensure client-facing documentation is consistent and professional.
• Communicate technical incident details clearly to technical and non-technical audiences.
• Collaborate with Managed IT team and on-site client visits.

Kenntnisse

Incident response

Threat hunting

Scripting (PowerShell)

Networking fundamentals

Analytical thinking

Documentation

Client communication

Regulatory frameworks

Ausbildung

Bachelor's degree in CS/IT

Tools

SentinelOne

ThreatLocker

Huntress

Arctic Wolf

Jobbeschreibung

ImageQuest, part of Lyra Technology Group, seeks a Lead SOC Engineer to act as the technical backbone of our SOC, based in Brentwood, TN. The role emphasizes escalations, incident response, tooling ownership, threat hunting, and automation within a managed services environment.

The ideal candidate has 3+ years in IT security with incident response or threat hunting, strong scripting and networking knowledge, and familiarity with Defender, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf.