{"id":3350295,"url":"https://alion.io/job/ahead-soc-team-lead","title":"SOC Team Lead","company":{"id":3614,"name":"AHEAD","domain":"ahead.com","url":"https://alion.io/company/ahead","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":74,"open_postings":39,"ghost_share":0,"stale_share":0.821,"repost_share":0,"time_to_fill_p50_days":74,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":110000,"max":140000,"currency":"USD","period":"year","gross":null,"usd_annual":140000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cortex","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Human-in-the-Loop","optional":false},{"name":"Incident Management","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-10-27T14:45:51Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-11-01T22:34:40Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift.\nThis role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes - not alert volume - and for meeting service-level commitments across a multi-tenant client base.\nThe ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team.\nSummary of Essential Job Functions\nOwn SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.\n\nManage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.\n\nServe as the primary quality-assurance checkpoint for the shift - reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.\n\nAct as the first point of escalation for analysts, providingtechnical guidance on complex investigations and making or supporting incident-declaration decisions.\n\nCoordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.\n\nOversee the human-in-the-loop layer on top of agentic triage and suppression - ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate clientcontext.\n\nCoach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.\n\nMonitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.\n\nEnsure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.\n\nPartner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.\n\nSupport client-facing communications during significant events, maintainingprofessionalism and clarity under pressure.\n\nEscalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvementculture.\n\nExperience and Certifications\n5-8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.\n\nPrior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.\n\nOne or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.\n\nHands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.\n\nTechnical Background Requirements\nDeep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.\n\nAdvanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.\n\nStrong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.\n\nWorking knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.\n\nFamiliarity with AI-assisted and agentic security operations and the governance / guardrails requiredto keep autonomy safe, auditable, and human-in-the-loop.\n\nUnderstanding ofservice-level objectivesand operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.\n\nRequired Skills\nStrong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.\n\nExcellent decision-making and judgment, especially under pressure and during active incidents.\n\nOutstanding verbal and written communication, including client-facing communication during significant events.\n\nAbility to uphold and enforce quality standards while developing people and maintainingteam morale.\n\nStrong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.\n\nAvailability to worka shift-based schedule, including nights, weekends, or holidays and on-call rotation as required.\n\nA continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.\n\nEducation\nBachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field - or equivalent professional experience and certifications.","description_format":"text","description_chars":5280,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","IT Consulting & Digital Transformation","Managed IT Services (MSP)","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-10-27T18:22:54Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 23 · green card filings: 4","filings_12m":23,"filings_prev_12m":21,"green_card_filings_12m":4,"median_offered_wage_usd":151759,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":4,"expected_fill_days":74,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-01T06:10:25Z"},"pay":{"stated_usd_annual":140000,"is_top_pay":false},"html_url":"https://alion.io/job/ahead-soc-team-lead","json_url":"https://alion.io/job/ahead-soc-team-lead.json","meta":{"generated_at":"2026-11-02T00:00:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3614},"rest":"https://alion.io/mcp/rest/get_company?id=3614"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fahead-soc-team-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fahead-soc-team-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fahead-soc-team-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ahead-soc-team-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fahead-soc-team-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3350295}},{"tool":"search_jobs","arguments":{"company":"ahead.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3350295},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}