SOC Lead

Qubika; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible work hours

Language lessons

Travel opportunities

Mentorship by senior team

Job summary

Qubika is seeking a Lead Security Operations professional to guide the SOC, detection engineering, threat intelligence, and incident response while staying hands-on with shifts and incident handling.

You will lead on-call scheduling, alert triage, detection rule tuning, and playbook improvements, mentoring analysts, and reporting key SOC metrics. Join a senior team delivering secure software for disruptive startups and enterprises.

Qualifications

• 8+ years in security operations with at least 2 years in a lead role.
• Proven hands-on experience with Microsoft Sentinel and Defender suite.
• Solid experience writing and tuning detection rules in KQL.
• Deep understanding of incident response lifecycle and leading IR on real incidents.

Responsibilities

• Own and manage the SOC rotating on-call schedule for 24/7 coverage.
• Triage and respond to security alerts, taking shifts and handling incidents with the team.
• Design, write, tune, and deprecate detection rules across SIEM and telemetry sources.
• Lead reduction of alert fatigue through systematic false-positive analysis.
• Oversee threat intelligence collection and ensure it informs detection rules and IR playbooks.
• Lead incident response operations: triage, containment, eradication, recovery, post-incident review.
• Act as technical lead on high-severity incidents coordinating across teams and clients.
• Mentor SOC analysts and detection engineers.
• Track and report SOC KPIs: MTTD, MTTR, false positives, escalation rate.

Skills

SOC leadership

Incident response

KQL

Threat intelligence

Cloud security

AI in security

English proficiency

Tools

Microsoft Sentinel

Microsoft Defender suite

SOAR

Job description

We are looking for a Lead Security Operations to join our team!

At Qubika, we design, develop, and deploy custom software solutions for organizations making an impact through technology.

About the role:

This is not a purely managerial position. You'll lead the people, processes, and tooling that power the SOC, detection engineering, threat intelligence, and incident response capabilities — and you'll stay technical: taking shifts and handling incidents alongside the team.

What you'll do:

• Own and manage the SOC rotating on-call schedule, ensuring 24/7 coverage with clear escalation paths
• Triage and respond to security alerts — taking shifts and handling incidents alongside the team
• Design, write, tune, and deprecate detection rules across SIEM and other telemetry sources
• Lead the reduction of alert fatigue through systematic false positive analysis
• Oversee threat intelligence collection and ensure it feeds detection rules, IOC enrichment, and IR playbooks
• Lead incident response operations: triage, containment, eradication, recovery, and post-incident review
• Act as technical lead on high‑severity incidents, coordinating across internal teams and client stakeholders
• Mentor and develop SOC analysts and detection engineers
• Track and report SOC KPIs: MTTD, MTTR, false positive rate, escalation rate

Requirements:

• 8+ years in security operations, with at least 2 years in a lead role
• Proven hands‑on experience with Microsoft Sentinel (log onboarding, analytics rules, workbooks, UEBA) and the Microsoft Defender suite (MDE, MDO, MDI, MDCA)
• Solid experience writing and tuning detection rules in KQL
• Deep understanding of the incident response lifecycle and direct experience leading IR on real incidents
• Working knowledge of threat intelligence frameworks: MITRE ATT&CK, Diamond Model, kill chain
• Experience with SOAR platforms and SOC workflow automation
• Cloud security operations experience (AWS, Azure, or GCP)
• Experience managing rotating on‑call schedules and operational workflows
• Practical experience applying AI tools in security workflows (Copilot for Security, custom GPTs, or equivalent)
• Professional working proficiency in English (written and spoken)
• On‑call availability required: one week per month on rotation

What we offer:

• Exciting and innovative projects for disruptive start‑ups and world‑class companies.
• A creative working environment with a positive and collaborative atmosphere within an open‑minded community.
• A senior team that offers mentorship opportunities to help you excel in your career.
• Various benefits include flexible work hours, ongoing skill development, language lessons, travel opportunities, engaging activities, expert talks, and more.

This job opening includes people registered in the National Registry for Persons with Disabilities (Registro Nacional de Personas con Discapacidad - Ley N° 19.691) who meet the conditions and suitability for the position. If you require any accommodations during the application process, please reach out to us at [e-mail].