SOC Team Lead

The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift. 

This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes — not alert volume — and for meeting service-level commitments across a multi-tenant client base. 

The ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team. 

Summary of Essential Job Functions

• • Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model. 

• • Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability. 

• • Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification. 

• • Act as the first point of escalation for analysts,providing technical guidance on complex investigations and making or supporting incident-declaration decisions. 

• • Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership. 

• • Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes arevalidated, tuned, and enriched withappropriate client context. 

• • Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development. 

• • Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment. 

• • Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement. 

• • Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise. 

• • Support client-facing communications duringsignificant events,maintaining professionalism and clarity under pressure. 

• • Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture. 

Experience and Certifications

• • 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience. 

• • Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred. 

• • One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIACySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications. 

• • Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies. 

Technical Background Requirements

• • Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management. 

• • Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework. 

• • Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case. 

• • Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise. 

• • Familiarity with AI-assisted and agentic security operations and the governance / guardrailsrequired to keep autonomy safe, auditable, and human-in-the-loop. 

• • Understanding of service-levelobjectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment. 

Required Skills

• • Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment. 

• • Excellent decision-making and judgment, especially under pressure and during active incidents. 

• • Outstanding verbal and written communication, including client-facing communication duringsignificant events. 

• • Ability to uphold and enforce quality standards while developing people andmaintaining team morale. 

• • Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously. 

• • Availability towork a shift-based schedule, including nights, weekends, or holidays and on-call rotation asrequired. 

• • A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation. 

Education

• • Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.