{"id":1163358,"url":"https://alion.io/job/about-admiral-group-plc-soc-lead","title":"SOC Lead","company":{"id":1180039,"name":"About Admiral Group PLC","domain":"joinadmiral.ca","url":"https://alion.io/company/joinadmiral","size_band":"1-10","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":120000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":120000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"LLM","optional":true},{"name":"Rest API","optional":true}],"status":"live","first_seen_at":"2026-09-22T16:27:16Z","employer_posted_date":"2026-09-22","last_verified_at":"2026-10-19T21:06:34Z","board_verified":true,"closed_at":null,"days_open":27,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":27},"description":"Note: This vacancy is a remote role intended for Atlantic Canadian and Ontario residents.\nAbout Admiral\nAdmiral is one of the UK's leading financial services companies, serving more than 9 million customers through insurance, lending, and other products. Since opening in Halifax in 2007, Admiral Canada has grown to nearly 400 colleagues and become an important part of Admiral's global operations, supporting customer, technology, and cyber security functions across the Group.\nCyber Security at Admiral\nCyber Security plays a critical role in protecting our customers, colleagues, data, and technology platforms. As a global financial services organisation, we operate in a complex and constantly evolving threat landscape, making security a key business priority.\nOur Canadian Cyber Security team is part of a 24/7 global operation, working alongside colleagues across multiple regions to detect threats, respond to incidents, strengthen security controls, and improve cyber resilience across the business.\nSince establishing our Cyber Security function in Canada in 2022, we've built a growing team of specialists across Security Operations, Incident Response, Security Engineering, and Threat Intelligence. Together, they help safeguard a business serving millions of customers while continuing to strengthen Admiral's global security capabilities.\nAbout the Job - Security Operations Centre Lead\nAs part of a 24/7 Global Security Operations Centre, the SOC Lead is responsible for leading and developing a team of Security Operations Analysts while ensuring the consistent delivery of high-quality security operations.\nWorking closely with colleagues across multiple regions, you will help oversee threat monitoring, investigation, and response activities, support effective operational handovers, and maintain the standards and processes that underpin a mature Security Operations function.\nThis role combines people leadership with strong security operations expertise. You will mentor and develop analysts, identify growth opportunities, strengthen team capability, and help create a culture of continuous learning and accountability. At the same time, you will provide technical guidance during investigations, support escalations, and act as a trusted leader within the SOC.\nSuccess in this role requires strong leadership skills, sound security judgement, excellent communication, and the ability to balance operational excellence with the ongoing development of a high-performing team.\nKey Responsibilities\nOperational Leadership & Coordination\nLead, mentor, and develop SOC analysts across three countries, ensuring consistent quality and performance across all regions.\nOversee day-to-day SOC monitoring activities, ensuring 24/7 operational coverage and seamless handovers across time zones.\nProvide expert guidance during investigations, escalations, and complex security incidents.\nEnsure all security events are triaged, investigated, documented, and remediated in accordance with SOC processes.\nMaintain a high level of situational awareness across all regional teams.\nStrategic Direction & Continuous Improvement\nContribute to the long-term SOC strategy, including capability growth, tooling advancement, and enhancements to the global operating model.\nDrive maturity improvements aligned with frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and defence-in-depth principles.\nIdentify and implement opportunities to enhance analyst effectiveness through improvements to processes, playbooks, tooling, and governance.\nLead annual and quarterly SOC roadmap planning and execution.\nAI, Automation & Engineering Collaboration\nDrive adoption of AI-assisted automated triage and machine-learning-based threat analysis.\nPartner with engineering teams to enhance SIEM/SOAR pipelines, enrich data sources, and reduce manual workload through targeted automation.\nOversee the tuning and optimisation of detection rules across monitoring platforms.\nIncident Response & Threat Analysis\nSupport incident investigations with technical leadership, rapid decision-making, and timely updates to stakeholders.\nEnsure lessons learned from incidents and threat intelligence activities are captured and integrated into processes and playbooks.\nStakeholder Management & Reporting\nAct as the SOC technical point of contact for internal stakeholders, including security leadership, technology teams, and business functions.\nCommunicate technical threats clearly to non-technical audiences, including senior management.\nLead regular SOC operational reviews, presenting insights into service performance, trends, risks, and improvement plans.\nSOC Metrics, Performance & Quality Assurance\nDevelop and maintain SOC KPIs and OKRs across all three regions.\nTrack metrics such as MTTD, MTTR, alert volumes, false positives, automation utilisation, analyst productivity, and rule effectiveness.\nEnsure continuous performance monitoring and drive improvements in SOC throughput and quality.\nConduct case reviews, root-cause analyses, and trend reporting to strengthen detection and response capabilities.\nPeople Leadership & Development\nBuild a culture of technical excellence, collaboration, and accountability across global teams.\nCoach and mentor analysts, identifying training needs, certification pathways, and career development opportunities.\nConduct performance reviews and support the professional development of junior and senior SOC analysts.\nFoster an inclusive, high-trust, globally aligned team environment.\nExperience and Qualifications Required\nRequired\n4+ years' experience in SOC operations and security monitoring.\nMinimum 3 years' experience leading and developing high-performing teams.\nStrong understanding of SIEM platforms.\nProven knowledge of MITRE ATT&CK, the Cyber Kill Chain, and modern threat actor behaviours.\nStrong communication, report-writing, presentation, and stakeholder-facing skills.\nHighly Desirable\nExperience with SOAR technologies.\nExperience with detection content and playbooks.\nFamiliarity with cloud environments (Azure, GCP) and cloud security practices.\nBackground in AI/ML security tools or LLM integration within SOC workflows.\nRelevant certifications (e.g., GCIH, GCIA, GCFE, GDAT, GCDA, GISP) are considered an asset.\nExperience in global follow-the-sun SOC operations.\nSalary, Benefits, and Work-Life Balance\nSalary starting at $120,000 annually. We offer a competitive total rewards package, with final compensation reflecting the experience, skills, and expertise of the successful candidate.\nAt Admiral, we know that great people do their best work when they're supported both professionally and personally. That's why we offer a comprehensive benefits package and are proud to be consistently recognized as one of the best workplaces in Canada and globally.\nAdmiral colleagues are eligible for five weeks of paid vacation annually, plus statutory holidays. Vacation entitlement increases with length of service, giving you even more time to rest, recharge, and enjoy life outside of work.\nLeann more about our employee benefits here: https://joinadmiral.ca/employee-benefits/\nOur Commitment to You\nAdmiral is committed to building a diverse and inclusive workplace. We are proud to be an equal opportunity employer and do not discriminate based on race, national origin, gender, gender identity, sexual orientation, disability, age, family status, or any other protected characteristic. We believe all qualified applicants should receive fair and equal consideration for employment.","description_format":"text","description_chars":7534,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Growth opportunities","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Property & Casualty Insurance"],"lifecycle":[{"event":"open","at":"2026-09-24T00:59:11Z"}],"visa":[],"liveness":{"score":53,"band":"ok","label":"Likely open","p_open":1,"p_active":0.711,"p_room":0.75,"age_days":26,"expected_fill_days":28,"reasons":["conf:3","win:late"],"computed_at":"2026-10-19T05:45:15Z"},"pay":{"stated_usd_annual":120000,"is_top_pay":false},"html_url":"https://alion.io/job/about-admiral-group-plc-soc-lead","json_url":"https://alion.io/job/about-admiral-group-plc-soc-lead.json","meta":{"generated_at":"2026-10-19T23:34:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2378,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1180039},"rest":"https://alion.io/mcp/rest/get_company?id=1180039"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fabout-admiral-group-plc-soc-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fabout-admiral-group-plc-soc-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fabout-admiral-group-plc-soc-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/about-admiral-group-plc-soc-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fabout-admiral-group-plc-soc-lead"}]}