Senior SOC & Incident Response Lead (Hybrid Remote)

Layer 8 Security; Pennsylvania; Hybrid; USD 120,000 - 190,000; Full time

Benefits offered by this job

Medical insurance

Life insurance

Unlimited vacation

Professional development

Employee voice

Job summary

Layer 8 Security is seeking a Senior Cybersecurity Consultant to lead our Security Operations practice. This hands-on, client-facing role requires guiding SOC operations, mentoring analysts, and delivering incident response engagements across a diverse client portfolio.

You will deploy and optimize EDR/XDR and SIEM platforms, coordinate cross-functional response activities, and present risk-based recommendations to executives. Hybrid work with travel to client sites.

Qualifications

• Senior cybersecurity leader with hands-on blue-team experience.
• Experience guiding SOC operations across multiple clients.
• Proven ability to mentor analysts and drive incident response programs.

Responsibilities

• Lead SOC analysts with day-to-day direction and performance guidance.
• Develop and optimize SOC workflows, escalation procedures, and response playbooks.
• Serve as technical escalation point for complex incidents and client inquiries.
• Manage EDR/XDR deployments across diverse client environments.
• Lead end-to-end incident response engagements from triage to post-incident review.
• Produce incident documentation including RCA and remediation roadmaps.
• Deliver security awareness training tailored to client workforce profiles.

Skills

SOC leadership

Incident response

Threat detection

Education

Industry certifications (CISSP, GCIH, GCIA, CEH, Security+)

Tools

EDR/XDR platforms (CrowdStrike, SentinelOne, Defender, Carbon Black)

SIEM solutions (Splunk, Defender, QRadar, Elastic)

Job description

Senior Cybersecurity Consultant, Blue Team Lead

Summary

We are looking for a seasoned Senior Cybersecurity Consultant to serve as a hands-on team lead within our Security Operations practice. This is a high-impact, client-facing role for a blue team professional who thrives in dynamic consulting environments, brings deep technical expertise across the defender stack, and has the leadership presence to mentor junior analysts and guide SOC operations across a diverse client portfolio. You will be the subject matter expert our clients rely on, leading incident response engagements, optimizing endpoint and detection strategies, and building security-aware cultures across organizations of varying size and maturity.

Role Responsibilities

SOC Team Leadership and Oversight

• Lead and manage a team of SOC analysts, providing day-to-day direction, mentorship, and performance guidance
• Establish and continuously improve SOC workflows, escalation procedures, and response playbooks
• Serve as a technical escalation point for complex incidents and client inquiries
• Foster a culture of continuous improvement, knowledge sharing, and professional development within the team
• Configure, deploy, and manage endpoint detection and response (EDR) and extended detection and response (XDR) platforms across diverse client environments, adapting quickly to each client’s existing toolset
• Optimize detection policies and sensor configurations to balance security effectiveness with operational continuity
• Generate, interpret, and present security reporting to identify threat trends and drive risk reduction recommendations
• Maintain currency with evolving EDR/XDR capabilities, platform updates, and industry best practices
• Lead end-to-end incident response engagements from initial triage through containment, eradication, and post-incident review
• Analyze alerts, telemetry, and indicators of compromise to assess scope, severity, and business impact
• Coordinate cross-functional response activities and communicate clearly with both technical teams and executive stakeholders
• Produce thorough incident documentation including root cause analysis, lessons learned, and strategic remediation roadmaps
• Design and deliver targeted security awareness programs tailored to client workforce profiles and risk posture
• Develop engaging training content addressing phishing, social engineering, insider threats, and secure behaviors
• Execute simulated phishing campaigns, analyze outcomes, and provide actionable improvement recommendations
• Track training effectiveness metrics and iterate program design based on data-driven insights
• Provide strategic security consulting and tactical recommendations aligned to client business objectives
• Support security assessments, gap analyses, audits, and compliance initiatives
• Contribute to the development and refinement of security policies, standards, and procedures for clients and internal practice growth
• Stay ahead of the evolving threat landscape, emerging vulnerabilities, and advancing security technologies

Qualifications and Requirements

• Industry certifications such as CISSP, GCIH, GCIA, CEH, Security+, or platform-specific credentials
• Experience operating across multiple EDR/XDR platforms (e.g., CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black) and SIEM solutions (e.g., Splunk, Microsoft Sentinel, IBM QRadar, Elastic)
• Familiarity with compliance frameworks including NIST CSF, ISO 27001, PCI-DSS, HIPAA, or SOC 2
• Prior experience in a cybersecurity consulting or managed security services (MSSP) environment
• Scripting or automation skills (Python, PowerShell, KQL, or similar) to support detection engineering and operational efficiency

Qualifications and Requirements

You are a builder and a leader, someone who can step into a client environment, quickly assess what’s there, and make it better. You communicate with confidence, operate with precision, and bring your team along with you.

• Detail-oriented with strong organizational and prioritization skills
• Proactive, self-directed, and comfortable owning outcomes in ambiguous situations
• Collaborative team leader with a strong client service orientation
• Genuinely committed to the craft, continuous learning is part of your identity

This is a hybrid position based out of our Malvern, Pennsylvania office, with flexibility for remote delivery and occasional on-site presence. Travel to client sites may be required depending on engagement needs.

Job Type: Full-time

Work Location: Hybrid remote in Malvern, PA 19355

• Medical, vision, and disability insurance program
• Employer-funded life insurance for all employees
• Unlimited vacation policy with a requirement to take at least two weeks
• Encourage and compensate for advanced training, certifications, and industry events
• Have a voice and be heard with the opportunity to make a positive difference

Layer 8 Security is an equal opportunity employer.

Functional Functional Always active

The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.

Preferences Preferences

The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.

Statistics Statistics

The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.

Marketing Marketing

The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.