Expert Service Operations Security / SOC

& TEAM As SOC Technical Authority, you will provide expert technical leadership across SOC operations, major security investigations, detection engineering, automation, and continuous SOC maturity improvement. You will be accountable for ensuring the technical quality of security monitoring, triage, investigation, escalation, detection coverage, and automation practices across the SOC. Reporting to the Senior Manager, Service Operations, you will be part of the SOC , responsible for protecting the organization through advanced security monitoring, threat detection, incident escalation, and continuous improvement of SOC capabilities. WHAT YOU WILL DO Act as the highest technical escalation point for SOC investigations, monitoring activities, and high-severity security events. Lead advanced security investigations by analyzing endpoint activity, network events, security telemetry, and investigative evidence to identify malicious activity and attack techniques. Provide technical leadership and mentoring to SOC Analysts and Senior SOC Analysts across day-to-day operations and complex investigations. Own and continuously improve the technical quality of monitoring, triage, investigation, escalation, and detection coverage across the SOC. Lead Detection Engineering by designing, implementing, validating, tuning, and improving detection use cases, correlation rules, analytics, and monitoring content. Map detection coverage against the MITRE ATT&CK framework to identify visibility gaps, detection gaps, and opportunities for improvement. Improve SIEM, SOAR, XDR, and security monitoring integrations by enhancing automation workflows and operational efficiency. Leverage threat intelligence to strengthen monitoring, detection, investigation, and response capabilities. Prepare technical reports, detection gap assessments, operational metrics, and security recommendations for SOC leadership and senior stakeholders. Collaborate with SIRT and relevant security teams by providing investigative findings, technical expertise, and security context during incident escalations, audits, cyber simulations, and security assessments.

Desired Candidate Profile

WHO YOU ARE You have 5 to 8 years of experience in Security Operations or Cyber Defense, including at least 3 years in a SOC role. You bring advanced expertise in security investigations, detection engineering, security monitoring, and technical SOC operations. You have expert knowledge of SIEM, SOAR, and XDR platforms, ideally including Elastic, Cortex, Microsoft Defender, and CrowdStrike. You have strong hands-on experience with Python, PowerShell, APIs, and security automation. You have strong knowledge of Azure or cloud security, identity security, and enterprise security environments. You understand and can practically apply the MITRE ATT&CK framework to improve detection coverage and investigation quality. You are experienced in using threat intelligence to enhance investigations, monitoring, detection logic, and SOC readiness. You can communicate complex technical findings clearly through reports, briefings, and recommendations for technical and senior stakeholders. You hold a Bachelor s degree in IT, Cybersecurity, Computer Science, or a related field. You hold at least one recognized cybersecurity certification, such as CISSP, GCIH, GCIA, SC-200, CySA+, or ECIH. NICE-TO-HAVE Experience supporting the evaluation, testing, and implementation of new security technologies and SOC capabilities. Experience participating in tabletop exercises, cyber simulations, audits, and security assessments. Strong ability to translate detection gaps, security risks, and technical findings into actionable recommendations for SOC leadership and CISO-level stakeholders.