SOC Lead (L4)

Level - L4

Reports to:

Position Summary:

The SOC Lead will lead the operations of the Security Operations Centre (SOC). The candidate should have deep expertise in security monitoring, incident response, threat intelligence and security technologies. This role is critical in safeguarding digital assets and ensuring rapid detection, response and mitigation of security incidents.

Key Responsibilities:

• Lead and manage the day-to-day operations of the Security Operations Centre (SOC) team.
• Oversee monitoring, detection, analysis, and response to security incidents using SIEM tools and other security technologies.
• Oversee tuning and optimization of SIEM platforms (e.g. Azure sentinel, LogRhythm, Splunk, QRadar, Wazuh etc.)
• Develop, implement, and maintain SOC processes, procedures, and playbooks to ensure effective incident response.
• Perform threat hunting and proactive analysis to identify emerging threats.
• Manage and mentor SOC analysts, providing training and professional development.
• Conduct root cause analysis and prepare detailed incident reports and recommendations.
• Drive continuous improvement in SOC capabilities through adoption of new tools and technologies.
• Participate in security audits, assessments, and vulnerability management initiatives.
• Stay up-to-date with the latest threat trends, vulnerabilities and regulatory requirements.

Required Qualifications:

• Minimum 12 years of professional experience in cybersecurity, with at least 8 years in a SOC environment.
• Deep understanding of networking, system administration, cloud environments (AWS/Azure/GCP) and security architecture.
• Experience with EDR, SIEM, SOAR, IDS/IPS, firewalls and forensic tools.
• Strong knowledge of malware analysis, log correlation, threat hunting and vulnerability management.
• Strong analytical and problem-solving skills with an investigative mindset.
• Excellent communication skills for technical and executive-level reporting.

Preferred Certifications:

• CISSP, GCIA, GCIH, CEH, OSCP, Security+, CySA+ or similar.
• SIEM-specific certifications (e.g. Azure Sentinel, LogRhythm, Splunk etc).

Education:

• BE CSE/IT or a related field, MCA with 60%+ throughout the academics.