SOC Lead, Professional Services Delivery Engineer IV

Accountabilities:

As the SOC Lead, you will manage security operations delivery, oversee critical incident handling, and continuously improve threat detection and response capabilities across customer environments. Your responsibilities will include:

• Lead and manage Security Operations Center activities within a managed security service provider (MSSP) environment, overseeing analysts and security engineers supporting multiple customers.

• Manage the complete incident response lifecycle, including detection, investigation, containment, escalation, resolution, and closure of critical Priority 1 (P1) security incidents.

• Conduct advanced threat hunting, forensic investigations, and post-breach analysis, producing detailed reports and actionable recommendations.

• Administer and optimize Microsoft Sentinel and Elastic Security SIEM platforms, including the design and management of Elastic Cloud Serverless SIEM deployments and integrations.

• Develop and maintain security use cases, detection rules, alerts, dashboards, reporting templates, and customer-specific monitoring capabilities.

• Apply threat intelligence and map attack techniques to the MITRE ATT&CK framework to strengthen detection engineering and proactive defense.

• Support cloud security monitoring and threat detection across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

• Design and implement security automation and orchestration workflows, including AI-enabled initiatives that improve SOC efficiency and response effectiveness.

• Maintain SOC documentation, incident response playbooks, standard operating procedures (SOPs), operational reports, and other service delivery documentation.

• Support security audits, governance activities, and compliance requirements related to ISO 27001, SOC 2, PCI DSS, NIST, CIS Controls, and other applicable frameworks.

• Manage customer engagements, communicate security findings and recommendations, and ensure service delivery meets contractual service-level agreements (SLAs).

• Lead, mentor, and develop SOC analysts and engineers, promoting technical excellence, continuous learning, and consistent operational practices.

• Identify opportunities to improve security processes, service quality, and customer outcomes while staying informed about emerging threats and technologies.

Requirements:

The ideal candidate is a proactive security operations leader with strong technical expertise, experience managing customer-facing SOC services, and the ability to respond effectively to complex cyber threats. The following qualifications and skills are required:

• Demonstrated experience leading and managing teams of security operations analysts and engineers.

• Professional experience working in an MSSP environment, preferably supporting multiple customers with diverse security requirements.

• Experience managing security operations in large-scale public cloud environments and implementing cloud-native security monitoring solutions.

• Hands-on knowledge of Microsoft Sentinel and Azure security technologies, including Azure Security Center or its successor capabilities.

• Experience with SIEM platforms, particularly Microsoft Sentinel and Elastic Security, including detection engineering, integrations, dashboards, and alert optimization.

• Familiarity with cloud security and threat detection tools across AWS and GCP, including AWS Security Hub, Amazon GuardDuty, and Google Security Command Center.

• Knowledge of vulnerability management tools such as Qualys and Microsoft Defender, as well as endpoint protection solutions including CrowdStrike and Microsoft Defender for Endpoint.

• Experience with the Microsoft Defender XDR suite and its role in threat investigation, detection, and response.

• Strong capabilities in incident investigation, threat hunting, forensic analysis, and the handling of critical security incidents.

• Understanding of security frameworks, compliance requirements, audit processes, and governance practices, including ISO 27001, SOC 2, PCI DSS, NIST, and CIS Controls.

• Excellent communication skills, with the ability to explain security concepts, incidents, and recommendations to both technical and non-technical audiences.

• Strong customer service orientation, attention to detail, initiative, and a commitment to continuous improvement.

• The ability to manage competing priorities, make sound decisions under pressure, and lead teams through complex security challenges.

The following certifications are preferred:

• Microsoft Certified: Cybersecurity Architect Expert (SC-100).

• Microsoft Certified: Security Operations Analyst (SC-200).

• Microsoft Certified: Azure Security Engineer Associate (AZ-500).

Benefits:

• Full-time employment in a remote-work setting within India.

• Opportunity to lead security operations for enterprise customers across complex, multi-cloud environments.

• Exposure to advanced cybersecurity technologies, threat intelligence, security automation, and AI-enabled operational initiatives.

• Opportunities to lead and develop a multidisciplinary team of security professionals.

• A collaborative, customer-focused environment that values technical expertise, accountability, agility, and continuous learning.

• The opportunity to contribute to cyber resilience and help customers protect critical infrastructure, data, and digital operations.