Senior SOC Lead: Threat Hunting & IR (Remote)

SPS Commerce; Minneapolis (MN); Hybrid; USD 108,200 - 140,000; Full time

Job summary

SPS Commerce is seeking a senior member of the Cyber Defense team to lead detection and response, guide the SOC, and manage escalations across SIEM, EDR, identity, and cloud telemetry. You will shepherd investigations, drive incident response, and proactively hunt threats to keep the SOC well‑prioritized and effective.

The ideal candidate has 5+ years in security operations with DFIR and SOC experience, strong communication skills, and a track record of improving detections and runbooks.

Qualifications

• 5+ years in security operations, incident response, or threat detection with senior‑level DFIR/SOC depth.
• Hands‑on investigation with a SIEM and an EDR platform; ability to pivot across identity, cloud, and network logs.
• Solid evidence handling and forensic fundamentals for disk, memory, and log artifacts.
• Familiarity with adversarial behavior and MITRE ATT&CK.
• Know‑how of exposure management workflows: triage, prioritization, remediation tracking.
• Clear written and verbal communication; able to brief engineers and executives effectively.
• Internal SPS candidates: SOC/IR/engineering experience with at least 1 year at SPS.
• Key Skills: DFIR, SIEM/EDR, threat hunting, MITRE ATT&CK, cloud monitoring, cross‑team comms, executive briefing.

Responsibilities

• Lead alert triage and investigation across SIEM/EDR and cloud, correlating data from multiple sources to determine escalation needs.
• Run incident response for high‑severity incidents: scoping, containment, stakeholder coordination, thorough documentation.
• Hunt for threats using current intelligence and surface coverage gaps before incidents occur.
• Incorporate AI and automation to accelerate investigations, summaries, and documentation; partner with engineering to operationalize.
• Collaborate with exposure management, security engineering, and cloud security on investigations and detections.
• Improve detections, runbooks, and tooling; provide coaching to analysts and feed enhancements to engineering.
• Develop the SOC: review determinations and escalation quality; participate in on‑call rotation.
• Perform other duties as assigned.

Skills

Digital forensics and incident

SIEM/EDR investigation

Threat hunting

MITRE ATT&CK

Cloud security monitoring

Cross-team communication

Executive briefing

Tools

CrowdStrike

SOAR platforms

NG-SIEM

AWS

Azure

GCP

EKS

Job description

SPS Commerce is seeking a senior member of the Cyber Defense team to lead detection and response, guide the SOC, and manage escalations across SIEM, EDR, identity, and cloud telemetry. You will shepherd investigations, drive incident response, and proactively hunt threats to keep the SOC well‑prioritized and effective.

The ideal candidate has 5+ years in security operations with DFIR and SOC experience, strong communication skills, and a track record of improving detections and runbooks.