SOC Team Lead

UnderDefense Inc.; United States; Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Superior technical team

Modern infrastructure

Ownership from day one

Direct collaboration with client’s top

security team

Job summary

UnderDefense Inc. is seeking a SOC Team Lead to build and run a SOC from the ground up for a global SaaS company with Fortune 500 clients. You’ll lead 6 Tier 2 analysts, own end-to-end incident response, and drive 24/7 coverage, playbooks, and SLAs while coordinating with Security Engineering.

You’ll be the escalation point for analysts and client IT/DevOps teams, setting the tone for incident handling and reporting KPIs to management and the client.

Qualifications

• 5+ years in SOC / incident response roles, including Tier 2/3 ownership.
• 2+ years of team lead or management experience in a SOC.
• Experience building and running 24/7 shift schedules and on-call rotations.
• Experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance).
• Experience leading or coordinating during active incidents.
• Cloud / AWS security experience: investigate and respond to cloud alerts.
• SaaS investigation experience.
• SIEM hands-on: Splunk with SPL queries; CrowdStrike is a plus.
• EDR: Defender and/or CrowdStrike.
• Windows and macOS environments knowledge.
• Strong communication bridging SOC and Security Engineering.

Responsibilities

• Lead the L2 analysts day-to-day, prioritization, playbooks, escalations, and onboarding.
• Own 24/7 coverage: build shift schedules and on-call rotations.
• Own incident response lifecycle from triage to closure and conduct post-incident reviews.
• Investigate hands-on with analysts; handle complex alerts beyond Tier 2.
• Measure and report team performance against KPIs and SLAs to management.
• Translate analyst pain points into detection tuning and improvements.
• Communicate status clearly with client security teams and management.

Skills

IR ownership

Team leadership

Shift planning

KPI & SLA reporting

Incident coordination

Cloud/AWS security

SaaS investigation

Windows & macOS knowledge

Strong communication

Tools

Splunk

Microsoft Defender

CrowdStrike

Okta

AWS

Job description

SOC Team Lead

About the Project: You’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+ offices, Fortune 500 clients). The customer Security team is super strong and the stack is superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing response processes so the internal team can focus on security engineering. You’re the escalation point for your analysts and the client’s IT, DevOps, and App Security teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering. This is not a ticket-closing role: you set the tone for how incidents are handled.

What You’ll Do

• Lead the team: run the L2 analysts day-to-day (prioritization, playbooks, escalations), hold team syncs and handovers, and mentor and onboard analysts
• Own 24/7 coverage: build and maintain shift schedules and on-call rotations so the SOC is always staffed
• Own incident response: lead the full lifecycle from triage to closure, coordinate high-severity events and run post-incident reviews
• Investigate hands‑on: be the escalation point and work complex alerts alongside analysts, beyond Tier 2 capability
• Measure and report: track team and individual performance and outcomes against KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and report to management and the client
• Bridge to Security Engineering: turn analyst pain points (false positives, alert fatigue, detection gaps) into detection tuning and improvement suggestions.
• Communicate clearly: work with the client’s security team at technical and managerial level, with honest status updates, including when something is unknown

What You Bring

Hard requirements

• 5+ years in SOC / incident response roles, including prior Tier 2/3 analyst experience. Not just monitoring: actual IR ownership
• 2+ years of team lead or management experience in a SOC, including shift lead or mentoring responsibility
• Proven experience building and running 24/7 shift schedules and on‑call rotations, and keeping coverage intact in practice
• Proven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance): you can show how you measured a team and improved it
• Experience leading or coordinating a team during an active incident, and the ability to describe it step by step
• Cloud / AWS security experience: ability to investigate and respond to cloud alerts on day one
• SaaS investigation experience
• SIEM hands‑on: Splunk (required), with the ability to write and read SPL queries. CrowdStrike SIEM is a strong plus
• EDR: Microsoft Defender and/or CrowdStrike
• Working knowledge of both Windows and macOS environments
• Strong communication skills, bridging SOC operations and Security Engineering. Intellectual honesty: you say “I don’t know” when you don’t know

Strong plus

• Identity platforms: Okta, Azure AD
• SOAR automation and threat hunting
• Experience building a SOC at level 4‑5 based on SOC‑CMM
• Feeding analyst findings into detection engineering (tuning, new detections)

Red Flags

• Only closing alerts without owning the IR process
• Never having owned a shift schedule, on‑call rota or KPI reporting
• Managing from the sidelines instead of investigating alongside the team
• Confident wrong answers instead of acknowledged gaps
• No ability to describe team coordination during a real incident

Tech Stack

• Splunk
• Microsoft Defender
• CrowdStrike
• Okta
• AWS

What We Offer

• Superior technical team and a great customer with massive modern infrastructure
• AI everywhere, with the ability to automate every step: work smarter, not harder
• Real ownership from day one to build the SOC processes, coverage model and KPIs
• Direct collaboration with the client’s senior security team

About this position

Location

Remote

Employment type

Full time

Department

Services