Security Operations Lead

Legends Global; West Conshohocken (PA); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life and disability insurance

Paid vacation

401k plan

Job summary

Legends Global is seeking a Security Operations Lead for a hybrid role based at our Conshohocken, PA HQ or Dallas/Frisco, TX. You will drive the SOC program, lead complex incidents, tune SIEM/EDR, and mentor analysts to improve detection and response capabilities.

You will build playbooks, develop enrichment pipelines, and champion automation-forward incident response while working with cross-functional teams to strengthen enterprise security posture.

Qualifications

• Three to five years of experience in Security Operations, Detection and Response, or Incident Handling.

Responsibilities

• Independently lead complex or high-impact security incidents and improve SOC processes, tools, and response capabilities.
• Provide technical guidance and mentorship to SOC Analysts, establishing standards for documentation, communication, and delivery.
• Build and operationalize SOC playbooks and escalation workflows.
• Lead alert triage, enrichment, prioritization, and false-positive suppression.
• Author detection requirements and tune SIEM rules.
• Develop threat-hunting hypotheses and lead hunt efforts using telemetry and threat intelligence.
• Design detection strategies across the kill chain and advance enterprise detection.
• Execute complex incidents end-to-end including containment, eradication, documentation, and communication.
• Conduct post-incident reviews and drive remediation and control improvements.
• Promote industry collaboration and embed resilient detection engineering practices.
• Advocate for automation-first incident response.

Skills

SOC Operations

Threat Hunting

Incident Response

Python/PowerShell/Bash

Communication

Tools

Google Security Operations

Microsoft Sentinel

IBM QRadar

CrowdStrike

Microsoft Defender

SentinelOne

Job description

Position

Security Operations Lead

Location

Hybrid (This person can be based out of our Dallas/Frisco, TX or Conshohocken, PA Corporate Headquarters)

Department

Technology

Reports To

VP, Cyber Security

Company Overview

LEGENDS GLOBAL Legends Global is the premier partner to the world’s greatest live events, venues, and brands. We deliver a fully integrated suite of premium services through a white-label model that keeps our partners front and center - from feasibility and project development to sales, partnerships, hospitality, merchandise, venue management, and world-class content and booking. With a global network of more than 450 venues, hosting 20,000 events and welcoming 165 million guests annually, Legends Global brings unmatched scale, expertise, and connectivity to help our partners grow. The Legends Global Way guides how we operate: Align, Scale, Connect, Team, Win - shared success, repeatable systems, connected solutions, unstoppable teams, and wins that are earned every day.

Key Responsibilities

• Independently lead complex or high-impact security incidents and identify opportunities to improve SOC processes, tools, and response capabilities.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and establishing standards for documentation, communication, and delivery.
• Build and operationalize SOC playbooks and escalation workflows.
• Lead alert triage, enrichment, prioritization, and false-positive suppression.
• Author detection requirements and write and tune SIEM rules.
• Develop threat-hunting hypotheses and lead hunt efforts using advanced telemetry and threat intelligence.
• Design detection strategies across the kill chain and help advance the enterprise detection strategy.
• Execute complex incidents end-to-end, including containment, eradication, documentation, and communication.
• Conduct post-incident reviews and drive remediation and control improvements.
• Promote industry collaboration and embed resilient detection engineering practices.
• Advocate for and implement automation-first incident response.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and setting standards for documentation, communication, and delivery.

Education and Experience

Proven experience in a SOC or equivalent detection and response function, with a focus on high-fidelity detections, repeatable playbooks, and measurable outcomes. Three to five years of experience in Security Operations, Detection and Response, or Incident Handling; SOC experience is required. Hands-on experience with SIEM platforms, such as Google Security Operations, Microsoft Sentinel, or IBM QRadar; EDR platforms, such as CrowdStrike, Microsoft Defender, or SentinelOne; and SOAR platforms. Proficiency in authoring detections, tuning rules, developing enrichment pipelines, and improving alert routing. Demonstrated experience building and executing incident-response playbooks and containment and eradication plans. Experience conducting post-incident reviews and root-cause analyses and delivering corrective action plans to engineering teams. Scripting skills in Python, PowerShell, or Bash for automation, enrichment, and data analysis. Excellent written communication skills, including case documentation and executive-ready incident summaries. Proficient in authoring detections, rule tuning, enrichment pipelines, and alert routing. Demonstrated capability in building and executing IR playbooks and containment/eradication plans. Experience conducting post-incident reviews and RCAs, and delivering corrective action plans to engineering teams. Scripting skills (Python/PowerShell/Bash) for automation, enrichment, and data wrangling. Excellent written communication for case documentation and executive-ready incident summaries.

Desired Skills and Abilities

• Demonstrates the ability to influence technical direction and cross-functional outcomes through expertise and sound judgment, without formal people-management responsibility.
• Transforms noisy telemetry into actionable signals.
• Is detail-oriented and disciplined in organizing information, developing repeatable playbooks, maintaining clear documentation, and closing feedback loops.
• Is prepared to mentor other analysts and set standards for SOC communication and delivery.
• Influences technical direction and cross-functional outcomes through expertise and sound judgment.
• Is comfortable presenting complex technical information to the CISO and other executive leaders.

Compensation

Competitive salary, commensurate with experience, and a generous benefits package that includes medical, dental, vision, life and disability insurance, paid vacation, and 401k plan.

Working Conditions

Location: Hybrid (This person can be based out of our Dallas/Frisco, TX or Conshohocken, PA Corporate Headquarters) NOTE: The essential responsibilities of this position are described under the headings above. They may be subject to change at any time due to reasonable accommodation or other reasons. Also, this document in no way states or implies that these are the only duties to be performed by the employee occupying this position. Legends Global is an Equal Opportunity/Affirmative Action employer, and encourages Women, Minorities, Individuals with Disabilities, and protected Veterans to apply. VEVRAA Federal Contractor. Our Work Experience is the combination of everything that's unique about us: our culture, our core values, our company meetings, our commitment to sustainability, our recognition programs, but most importantly, it's our people. Our employees are self-disciplined, hard working, curious, trustworthy, humble, and truthful. They make choices according to what is best for the team, they live for opportunities to collaborate and make a difference, and they make us the #1 Top Workplace in the area.