[Hiring] SOC Team Lead @Ahead

Role Description

The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift.

This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes — not alert volume — and for meeting service-level commitments across a multi-tenant client base.

• Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.
• Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.
• Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.
• Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions.
• Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.
• Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context.
• Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.
• Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.
• Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.
• Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.
• Support client-facing communications during significant events, maintaining professionalism and clarity under pressure.
• Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture.

Qualifications

• 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.
• Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.
• One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.
• Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.

Requirements

• Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.
• Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.
• Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.
• Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.
• Familiarity with AI-assisted and agentic security operations and the governance / guardrails to keep autonomy safe, auditable, and human-in-the-loop.
• Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.

Required Skills

• Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.
• Excellent decision-making and judgment, especially under pressure and during active incidents.
• Outstanding verbal and written communication, including client-facing communication during significant events.
• Ability to uphold and enforce quality standards while developing people and maintaining team morale.
• Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.
• Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation.
• A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.

Education

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.

Benefits

• Medical, Dental, and Vision Insurance
• 401(k)
• Paid company holidays
• Paid time off
• Paid parental and caregiver leave
• Plus more! See benefits here for additional details.