Remote SOC Team Lead - 24/7 Incident Response & KPIs

UnderDefense Inc.; United States; Remoto; USD 150.000 - 190.000; Tempo pieno

Vantaggi offerti da questo lavoro

Superior technical team

Modern infrastructure

Ownership from day one

Direct collaboration with client’s top

security team

Descrizione del lavoro

UnderDefense Inc. is seeking a SOC Team Lead to build and run a SOC from the ground up for a global SaaS company with Fortune 500 clients. You’ll lead 6 Tier 2 analysts, own end-to-end incident response, and drive 24/7 coverage, playbooks, and SLAs while coordinating with Security Engineering.

You’ll be the escalation point for analysts and client IT/DevOps teams, setting the tone for incident handling and reporting KPIs to management and the client.

Competenze

• 5+ years in SOC / incident response roles, including Tier 2/3 ownership.
• 2+ years of team lead or management experience in a SOC.
• Experience building and running 24/7 shift schedules and on-call rotations.
• Experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance).
• Experience leading or coordinating during active incidents.
• Cloud / AWS security experience: investigate and respond to cloud alerts.
• SaaS investigation experience.
• SIEM hands-on: Splunk with SPL queries; CrowdStrike is a plus.
• EDR: Defender and/or CrowdStrike.
• Windows and macOS environments knowledge.
• Strong communication bridging SOC and Security Engineering.

Mansioni

• Lead the L2 analysts day-to-day, prioritization, playbooks, escalations, and onboarding.
• Own 24/7 coverage: build shift schedules and on-call rotations.
• Own incident response lifecycle from triage to closure and conduct post-incident reviews.
• Investigate hands-on with analysts; handle complex alerts beyond Tier 2.
• Measure and report team performance against KPIs and SLAs to management.
• Translate analyst pain points into detection tuning and improvements.
• Communicate status clearly with client security teams and management.

Conoscenze

IR ownership

Team leadership

Shift planning

KPI & SLA reporting

Incident coordination

Cloud/AWS security

SaaS investigation

Windows & macOS knowledge

Strong communication

Strumenti

Splunk

Microsoft Defender

CrowdStrike

Okta

AWS

Descrizione del lavoro

UnderDefense Inc. is seeking a SOC Team Lead to build and run a SOC from the ground up for a global SaaS company with Fortune 500 clients. You’ll lead 6 Tier 2 analysts, own end-to-end incident response, and drive 24/7 coverage, playbooks, and SLAs while coordinating with Security Engineering.

You’ll be the escalation point for analysts and client IT/DevOps teams, setting the tone for incident handling and reporting KPIs to management and the client.