Security Operations Shift Lead: Cyber Triage & Forensics

Ernst & Young Oman; Nashville (TN); Hybrid; USD 91,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Job summary

EY is hiring a CTF Shift Lead to supervise the Cyber Triage and Forensics team in the United States. You will manage junior and senior analysts, drive incident response, set performance expectations, and provide technical leadership. The role supports a global security program with a hybrid work model.

You should have a Bachelor's in CS/InfoSec and 4–5 years in SOC, plus Linux/Windows admin, scripting, and familiarity with SIEM/IDS/IPS. Certifications are a plus.

Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Information Security, or equivalent with 3–4 years of experience.
• 4–5 years in Security Monitoring/SOC environment.
• Experience with electronic investigation and log correlation.
• Linux and/or Windows system administration including Active Directory.
• Scripting or programming skills (Python, PowerShell, Shell, etc.).

Responsibilities

• Manage day-to-day operations and performance of the CTF Analysts.
• Ensure prompt response to email and case queues.
• Distribute workload among threat hunting team and oversee activities.
• Participate in analysis and triage of security events.
• Provide technical leadership and mentorship to junior analysts.
• Set clear performance expectations and manage team performance.
• Report case status and significant incident updates to the global lead.
• Update SOPs and drive continuous improvement.

Skills

Security monitoring

SOC experience

Threat analysis

Leadership

TCP/IP

Linux/Windows

Technical writing

Education

Bachelor's in Computer Science / Information Security

Tools

SIEM platforms

IDS/IPS

EDR

Active Directory

Job description

EY is hiring a CTF Shift Lead to supervise the Cyber Triage and Forensics team in the United States. You will manage junior and senior analysts, drive incident response, set performance expectations, and provide technical leadership. The role supports a global security program with a hybrid work model.

You should have a Bachelor's in CS/InfoSec and 4–5 years in SOC, plus Linux/Windows admin, scripting, and familiarity with SIEM/IDS/IPS. Certifications are a plus.