SOC Team Lead
Confirmed on the employer's own hiring board on Oct 31, 2026. First seen by Alion on Oct 27, 2026. AHEAD scores B on the Alion truth index.
The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift.
This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes - not alert volume - and for meeting service-level commitments across a multi-tenant client base.
The ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team.
Summary of Essential Job Functions
Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.
Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.
Serve as the primary quality-assurance checkpoint for the shift - reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.
Act as the first point of escalation for analysts, providingtechnical guidance on complex investigations and making or supporting incident-declaration decisions.
Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.
Oversee the human-in-the-loop layer on top of agentic triage and suppression - ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate clientcontext.
Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.
Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.
Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.
Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.
Support client-facing communications during significant events, maintainingprofessionalism and clarity under pressure.
Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvementculture.
Experience and Certifications
5-8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.
Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.
One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.
Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.
Technical Background Requirements
Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.
Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.
Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.
Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.
Familiarity with AI-assisted and agentic security operations and the governance / guardrails requiredto keep autonomy safe, auditable, and human-in-the-loop.
Understanding ofservice-level objectivesand operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.
Required Skills
Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.
Excellent decision-making and judgment, especially under pressure and during active incidents.
Outstanding verbal and written communication, including client-facing communication during significant events.
Ability to uphold and enforce quality standards while developing people and maintainingteam morale.
Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.
Availability to worka shift-based schedule, including nights, weekends, or holidays and on-call rotation as required.
A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.
Education
Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field - or equivalent professional experience and certifications.