Security Operations Lead

STL Digital; United States; Remote; USD 140,000 - 180,000; Full time

Job summary

STL Digital is seeking a Lead Security Operations professional to oversee security monitoring, detection, and incident response. You will coordinate day-to-day SOC activities, validate alerts, and ensure escalations are handled by the right owners, reporting through established governance channels.

You will develop detection logic, lead threat hunts, and drive service improvements while coaching colleagues. The role requires extensive experience in security operations and leadership.

Qualifications

• Hands-on security operations experience with incident investigation and escalation.
• Ability to interrogate SIEM/EDR data, tune detections, and automate safely.
• Familiarity with MSSP oversight and risk-led security operations.

Responsibilities

• Monitor and coordinate the SOC service, validate alerts, and oversee investigations.
• Lead incident response, preserve evidence integrity, and coordinate recovery actions.
• Develop detections, hunt threats, and validate controls for reliable telemetry.
• Coach teams, maintain playbooks, and drive continuous improvement.

Skills

SOC & IR

Operational Leadership

Certifications

Job description

Lead Security Operations

Experience: 8+ Yrs.

Work Mode: Remote

Shift: UK Shift (1 PM to 9 PM / 2 PM to 10 PM)

Role Purpose

Provide practical technical leadership for security monitoring, detection, and operational incident response. Coordinate the security operations service so that credible threats are identified, investigated, and escalated consistently, and agreed response actions are executed safely. Translate attack lessons and service evidence into better detections, response readiness, and prioritised improvement, while coaching colleagues and maintaining dependable operational standards.

Scope & Governance Boundaries

• Operational Scope & Authority: Lead day-to-day technical priorities, triage quality, and operational coordination within the scope, policies, and playbooks agreed by the VP Cyber Security Operations. Recommend improvements and allocate operational work within confirmed authority. This role does not assume ownership of security strategy, approved budgets, staffing decisions, or enterprise-wide risk acceptance.
• Incident & Containment Boundaries: Execute authorised response playbooks and elevate incidents, confirmed threats, and exceptions promptly. Disruptive containment (service isolation/shutdown) requires authority specified in approved incident arrangements; urgency does not create additional delegation. Crisis leadership, material business decisions, and external communications remain with designated accountable leaders. Legal and the DPO govern regulatory notifications.
• Governance Accountabilities: The CISO retains security strategy and governance accountability; authorised business owners retain risk acceptance. Formal people-management duties, spending limits, and out-of-hours participation must be explicitly agreed.
• Reporting & Cross-Functional Alignment: Work with the VP Cyber Security Operations on service priorities, escalations, and readiness, and with the CISO on material security issues through agreed reporting routes. Partner with Security GRC on policy interpretation, risk evidence, assurance, and exceptions. Engage Legal, DPO, and crisis leaders through approved procedures.
• Functional Boundaries: Maintain a clear boundary with Security Architecture & Engineering. Operations owns monitoring, detections, and operational response, feeding attack lessons into engineering. Architecture & Engineering owns secure designs, control engineering, and operational handover. Both functions jointly accept logging coverage, runbooks, maintainability, and observability.
• Remediation & Service Management: Asset, application, and platform owners execute assigned remediation/recovery changes, with Operations supplying evidence, priorities, and follow-up. Coordinate with technology service management, business owners, and security service providers (MSSP) to align incident handling with service impact and change control.

Key Responsibilities

• Monitoring & Service Coordination: Coordinate the SOC service, queues, and handovers across internal teams and service providers. Validate alerts, establish severity and business context, oversee investigation quality, and ensure escalation reaches the right accountable owner. Maintain case records, operational procedures, and service health checks; identify monitoring gaps and drive remediation.
• Incident Response & Readiness: Lead technical investigation and coordinate agreed response activities, documenting hypotheses, findings, decisions, and escalation. Preserve evidence integrity, timestamps, provenance, access controls, and chain of custody in accordance with retention and privacy requirements. Maintain and exercise playbooks, coordinate recovery validation with platform owners, and turn post-incident reviews into assigned improvements. Support incident preparedness exercises and executive briefings.
• Detection Engineering & Automation: Develop, test, tune, and maintain detection logic against agreed threat scenarios and available telemetry. Use SIEM, EDR, and SOAR capabilities without vendor lock-in. Apply controlled changes, versioning, validation, and rollback to rules and automation; remove noise while retaining useful signals and human approval for sensitive actions.
• Threat Hunting & Control Validation: Plan hypothesis-led hunts and assess threat intelligence for relevance. Correlate endpoint, identity, network, and cloud evidence to identify activity not captured by existing alerts. Partner on authorised threat-led validation/testing, confirming controls produce usable telemetry and detections, recording blind spots, and translating findings into operational requirements.
• Exposure & Service Improvement: Use exploitability, threat activity, asset criticality, and compensating controls to recommend vulnerability priorities. Follow up assigned remediation with asset/platform owners, validate operational evidence of completion, and elevate overdue exposure.
• Technical Leadership & Coaching: Set clear technical standards and model calm, evidence-led judgement during incidents. Maintain meaningful operational measures, explain service limitations, and report improvement priorities to the VP Cyber Security Operations. Agree baselines, definitions, reporting cadence, and targets after reviewing service scope and data quality.

Skills, Qualifications & Experience

• SOC & Incident Response: Demonstrable hands-on experience in security operations and incident investigation, including alert validation, evidence analysis, severity assessment, and timely escalation. Practical ability to interrogate SIEM and EDR data, build and tune detections, and use scripting or automation safely. Deep understanding of attacker behaviours and identity, endpoint, network, and cloud telemetry.
• Operational Leadership: Evidence of technical leadership: coordinating operational work, coaching colleagues, improving investigation quality, and communicating clearly under pressure. Ability to maintain playbooks, preserve evidence, work within change controls, and collaborate with engineering on remediation. Ability to translate technical findings into business implications and use metrics for real service improvement.
• Certifications & Specialized Experience: Relevant incident response, threat hunting, or security operations certifications (or equivalent practical experience). Experience in payment/transaction-sensitive environments, cloud and identity investigations, purple-team exercises, detection-as-code, and safe orchestration of response workflows. Familiarity with managed security service (MSSP) oversight is highly beneficial.