SOC Lead, Professional Services Delivery Engineer IV

Your tasks

As the SOC Lead, you will manage security operations delivery, oversee critical incident handling, and continuously improve threat detection and response capabilities across customer environments. Your responsibilities will include:

• Lead and manage Security Operations Center activities within a managed security service provider (MSSP) environment, overseeing analysts and security engineers supporting multiple customers.
• Manage the complete incident response lifecycle, including detection, investigation, containment, escalation, resolution, and closure of critical Priority 1 (P1) security incidents.
• Conduct advanced threat hunting, forensic investigations, and post-breach analysis, producing detailed reports and actionable recommendations.
• Administer and optimize Microsoft Sentinel and Elastic Security SIEM platforms, including the design and management of Elastic Cloud Serverless SIEM deployments and integrations.
• Develop and maintain security use cases, detection rules, alerts, dashboards, reporting templates, and customer-specific monitoring capabilities.
• Apply threat intelligence and map attack techniques to the MITRE ATT&CK framework to strengthen detection engineering and proactive defense.
• Support cloud security monitoring and threat detection across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
• Design and implement security automation and orchestration workflows, including AI-enabled initiatives that improve SOC efficiency and response effectiveness.
• Maintain SOC documentation, incident response playbooks, standard operating procedures (SOPs), operational reports, and other service delivery documentation.
• Support security audits, governance activities, and compliance requirements related to ISO 27001, SOC 2, PCI DSS, NIST, CIS Controls, and other applicable frameworks.
• Manage customer engagements, communicate security findings and recommendations, and ensure service delivery meets contractual service-level agreements (SLAs).
• Lead, mentor, and develop SOC analysts and engineers, promoting technical excellence, continuous learning, and consistent operational practices.
• Identify opportunities to improve security processes, service quality, and customer outcomes while staying informed about emerging threats and technologies.

Requirements

The ideal candidate is a proactive security operations leader with strong technical expertise, experience managing customer-facing SOC services, and the ability to respond effectively to complex cyber threats. The following qualifications and skills are required:

• Demonstrated experience leading and managing teams of security operations analysts and engineers.
• Professional experience working in an MSSP environment, preferably supporting multiple customers with diverse security requirements.
• Experience managing security operations in large-scale public cloud environments and implementing cloud-native security monitoring solutions.
• Hands-on knowledge of Microsoft Sentinel and Azure security technologies, including Azure Security Center or its successor capabilities.
• Experience with SIEM platforms, particularly Microsoft Sentinel and Elastic Security, including detection engineering, integrations, dashboards, and alert optimization.
• Familiarity with cloud security and threat detection tools across AWS and GCP, including AWS Security Hub, Amazon GuardDuty, and Google Security Command Center.
• Knowledge of vulnerability management tools such as Qualys and Microsoft Defender, as well as endpoint protection solutions including CrowdStrike and Microsoft Defender for Endpoint.
• Experience with the Microsoft Defender XDR suite and its role in threat investigation, detection, and response.
• Strong capabilities in incident investigation, threat hunting, forensic analysis, and the handling of critical security incidents.
• Understanding of security frameworks, compliance requirements, audit processes, and governance practices, including ISO 27001, SOC 2, PCI DSS, NIST, and CIS Controls.
• Excellent communication skills, with the ability to explain security concepts, incidents, and recommendations to both technical and non-technical audiences.
• Strong customer service orientation, attention to detail, initiative, and a commitment to continuous improvement.
• The ability to manage competing priorities, make sound decisions under pressure, and lead teams through complex security challenges.

The following certifications are preferred

• Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• Microsoft Certified: Security Operations Analyst (SC-200).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500).

What we offer

• Full-time employment in a remote-work setting within India.
• Opportunity to lead security operations for enterprise customers across complex, multi-cloud environments.
• Exposure to advanced cybersecurity technologies, threat intelligence, security automation, and AI-enabled operational initiatives.
• Opportunities to lead and develop a multidisciplinary team of security professionals.
• A collaborative, customer-focused environment that values technical expertise, accountability, agility, and continuous learning.
• The opportunity to contribute to cyber resilience and help customers protect critical infrastructure, data, and digital operations.

Other

How Jobgether works We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.