Technical SOC Lead

Position: Technical SOC Lead

Work experience: 10+ years

Job location: Mumbai (WFO)

Normal Shift

Job Description

We are seeking a Technical SOC Lead to manage and guide the Security Operations Center (SOC) team in detecting, analyzing, and responding to cybersecurity incidents. The ideal candidate will be a hands-on leader with deep technical expertise in security tools, incident response, and threat analysis.

Mandatory and Must skills:

• Technical soc lead who can manage a team size of 20 people and having experience in banking sector and can face bank audit.


• Strong hands-on experience with SIEM tools in IBM QRadar

Key Responsibilities:

• Lead day-to-day operations of the SOC, ensuring 24/7 security monitoring and incident handling


• Act as technical escalation point for complex security issues and provide guidance to L1/L2/L3 analysts


• Analyze security incidents and lead response efforts including root cause analysis


• Tune and optimize SIEM rules and correlation logic (e.g., Splunk, QRadar, ArcSight)


• Implement and manage threat detection and prevention systems


• Work closely with threat intelligence teams to correlate global threats with internal activity


• Conduct proactive threat hunting activities


• Develop and maintain incident response playbooks and standard operating procedures


• Provide regular status updates and risk analysis to management


• Train and mentor junior SOC staff to build capability and resilience

Technical Skills Required:

• Strong hands-on experience with SIEM tools (e.g., Splunk, QRadar, LogRhythm)


• Good knowledge of network protocols, firewalls, IDS/IPS, proxies, endpoint protection


• Familiarity with incident response frameworks (NIST, SANS)


• Ability to analyze logs, packet captures, malware samples, etc.


• Experience with SOAR platforms and automation of security processes


• Knowledge of MITRE ATT&CK framework


• Scripting knowledge (Python, Bash, PowerShell) is a plus

Certifications (Preferred):

• GCIA, GCIH, CEH, CISSP, OSCP or similar