MDR Team Lead

Accountabilities

Serve as the primary technical and operational escalation point for complex investigations, security incidents, and other matters related to Managed Detection and Response (MDR) services.
Oversee the monitoring, triage, investigation, and escalation of security incidents to ensure potential threats to customer data are identified and addressed promptly.
Validate investigative findings, guide analysts through complex cases, and coordinate investigative activities with customers and internal technical teams.
Ensure that all investigations, incident findings, response actions, and relevant communications are accurately documented and tracked in the CRM and other designated systems.
Lead or participate in customer calls as required, providing clear updates, explaining investigative findings, and representing the MDR service professionally.
Recruit, onboard, and develop MDR Security Analysts, ensuring new and existing team members have the technical knowledge and operational skills needed to perform effectively.
Conduct regular performance reviews, provide constructive feedback, and carry out quarterly SWOT analyses to identify strengths, development opportunities, and areas for improvement.
Establish a collaborative and accountable team culture while building strong working relationships within the MDR team and across departments, including Product Support, Product Management, and Engineering.
Ensure adherence to operational policies, established procedures, service-level agreements (SLAs), and quality standards across all MDR activities.
Contribute to the development, documentation, testing, analysis, and continuous improvement of threat detection systems, investigative playbooks, operational runbooks, and service workflows.
Maintain up-to-date knowledge of the MDR service, cybersecurity threats, detection capabilities, and incident response practices to support effective operational decision-making.
Oversee and execute programs, projects, and operational initiatives that improve service performance, strengthen threat detection, and enhance the overall customer experience.
Monitor operational performance and proactively address process gaps, technical challenges, and service delivery risks to maintain consistent coverage and reliable security operations.
Requirements
At least 4 years of experience in cybersecurity operations within a global cybersecurity company, including practical involvement in security monitoring, threat detection, investigation, and incident response.
A minimum of 2 years of experience leading a team, with demonstrated success in team management, technical guidance, performance development, and operational coordination.
A degree or relevant certifications in cybersecurity, or demonstrable expertise across multiple cybersecurity operations disciplines.
Proven ability to deliver security operations services while meeting SLAs, operational targets, established procedures, and customer expectations.
Strong understanding of common security technologies and tools, including network-based security solutions such as firewalls and intrusion detection systems (IDS); host-based solutions such as endpoint detection and response (EDR) and antivirus (AV); data security technologies such as data loss prevention (DLP) and data security posture management (DSPM); and identity-based solutions such as privileged access management (PAM) and identity and access management (IAM).
Experience handling complex security investigations, validating findings, assessing risks, and guiding incident response and escalation activities.
Demonstrated ability to lead, mentor, and develop technical teams, with strong coaching skills and a commitment to continuous learning and professional growth.
Excellent analytical and critical-thinking skills, with the ability to interpret technical information, investigate complex issues, and make sound decisions under pressure.
Strong problem-solving abilities, including the creativity and resourcefulness needed to address unfamiliar technical challenges and improve operational processes.
Excellent written and verbal English communication skills, with the ability to explain technical findings clearly to analysts, colleagues, customers, and other stakeholders.
Strong interpersonal and relationship-building skills, with the ability to collaborate effectively across teams and manage customer-facing discussions professionally.
Exceptional attention to detail, sound judgment, and the ability to work autonomously while maintaining accountability for operational outcomes.
Willingness to work a shift aligned with global security operations requirements. The role may require either a morning shift from 6:30 AM to 3:30 PM IST or an afternoon shift from 2:00 PM to 11:00 PM IST.
Benefits
Remote work: Opportunity to work remotely from India.
Leadership opportunities: Take ownership of a cybersecurity operations team and contribute to its technical development, performance, and long-term growth.
Meaningful security impact: Help protect sensitive customer data by supporting continuous monitoring, threat detection, investigation, and incident response.
Technical development: Work with a broad range of security technologies, detection systems, investigative playbooks, and incident response processes.
Global collaboration: Partner with international customers and cross-functional teams in cybersecurity, product support, product management, and engineering.
Continuous improvement: Contribute to operational projects, detection enhancements, and process improvements in a dynamic security environment.
Professional growth: Strengthen both technical leadership and cybersecurity operations expertise while managing complex investigations and service delivery.
Collaborative culture: Join a team-oriented environment that values technical excellence, attention to detail, accountability, and shared problem-solving.
Structured shift options: Work within defined morning or afternoon shift schedules aligned with operational needs.