{"id":284030,"url":"https://alion.io/job/cyble-ai-soc-lead","title":"AI SOC Lead","company":{"id":2698,"name":"Cyble","domain":"cyble.com","url":"https://alion.io/company/cyble","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Work at a Startup","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":18000,"max":25000,"currency":"USD","period":"year","gross":null,"usd_annual":25000},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Diamond Model","optional":false},{"name":"GCP","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"ISO 27001","optional":true},{"name":"NIST CSF","optional":true},{"name":"PCI DSS","optional":true},{"name":"Red Teaming","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-09-05T13:45:40Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-26T02:44:20Z","board_verified":true,"closed_at":null,"days_open":50,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":50},"description":"About the Role:\nWe are looking for a seasoned SOC Lead who can blend deep cybersecurity expertise with a forward-thinking approach to AI-driven detection and response. In this leadership role, you will be the linchpin between frontline analysts and executive stakeholders - driving operational excellence, championing AI/ML tooling, including Cyble's own intelligence platform, and ensuring threats are detected, triaged, and contained with speed and precision.\nYou will own the SOC's day-to-day operations while continuously elevating the team's capabilities through automation, threat intelligence, and a culture of continuous improvement.\nWhat You'll Do At CYBLE:\nLeadership & Operations\nLead, mentor, and develop a team of SOC analysts (Tier 1-3), fostering a high-performance security culture\nOversee 24×7 SOC operations, ensuring coverage, SLA adherence, and escalation procedures are consistently followed\nAct as the primary point of escalation for complex or high-severity incidents\nConduct regular team reviews, shift handovers, and post-incident retrospectives\nAI-Augmented Detection & Response\nChampion the adoption of AI/ML tools for behavioural analytics, anomaly detection, and threat correlation - including Cyble's AI-powered threat intelligence platform\nLeverage Cyble Vision and Cyble's dark web intelligence feeds to enrich detection use cases and proactively identify emerging threats\nIntegrate and tune AI-powered SIEM, SOAR, and EDR platforms to reduce false positives and improve detection fidelity\nDevelop and maintain AI-assisted playbooks for automated triage and initial response actions\nEvaluate emerging AI security products and recommend adoptions aligned to the threat landscape\nMonitor AI model performance and ensure explainability and auditability of automated decisions\nThreat Detection & Triage\nOversee alert triage workflows, ensuring timely and accurate classification of security events\nDevelop and maintain detection rules, correlation logic, and use cases across SIEM and XDR platforms\nEstablish triage SLAs and quality benchmarks; regularly audit analyst triage accuracy\nLeverage threat intelligence feeds to continuously refine detection coverage and reduce dwell time\nIncident Response\nLead end-to-end incident response for critical and high-severity security incidents\nCoordinate containment, eradication, and recovery activities in line with the IR framework\nProduce clear, executive-level incident reports and root cause analyses (RCAs)\nConduct post-incident reviews and drive lessons-learned into process and detection improvements\nLiaise with legal, compliance, and external stakeholders during significant breaches\nProcess Improvement & Reporting\nDefine and track key SOC metrics (MTTD, MTTR, false positive rates, coverage gaps)\nContinuously refine and document SOC runbooks, playbooks, and standard operating procedures\nPrepare regular reporting for CISO and board-level audiences on SOC posture and key incidents\nDrive automation initiatives to improve analyst efficiency and reduce manual workload\nWhat You’ll Need:\nExperience\n4-6 years of progressive cybersecurity experience, with at least 2 years in a SOC leadership or senior analyst role\nProven hands-on experience with SIEM platforms (e.g., Splunk, Microsoft Sentinel, IBM QRadar)\nStrong background in incident response, digital forensics, and threat hunting\nExperience integrating or operating AI/ML-powered security tools (UEBA, NDR, AI-assisted SOAR)\nTechnical Skills\nDeep understanding of attack frameworks: MITRE ATT&CK, Cyber Kill Chain, Diamond Model\nProficiency in network forensics, log analysis, and endpoint investigation techniques\nHands-on experience with SOAR platforms (e.g., Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel Playbooks)\nWorking knowledge of cloud security monitoring (AWS, Azure, GCP) and cloud-native threat detection\nScripting ability in Python, PowerShell, or KQL for automation and detection rule development\nFamiliarity with threat intelligence platforms\nSoft Skills & Leadership\nExceptional communication skills - able to translate technical findings to non-technical executives\nStrong analytical thinking and ability to make sound decisions under pressure\nProven ability to build, coach, and retain high-performing security teams\nCollaborative mindset with cross-functional stakeholders, including IT, Legal, and Risk\nBONUS POINTS IF YOU HAVE:\nIndustry certifications: CISSP, CISM, GCIA, GCIH, GDAT, CEH, Microsoft SC-200, or equivalent\nHands-on experience with Cyble Vision, Cyble CSPM, or equivalent AI-driven threat intelligence and attack surface management platforms\nPrior experience in a regulated industry (BFSI, healthcare, critical infrastructure)\nFamiliarity with compliance frameworks: ISO 27001, NIST CSF, SOC 2, PCI-DSS\nExposure to red team / purple team engagements and adversary simulation exercises\nExperience with deception technologies, honeypots, or active defence strategies\nCV Shortlist by the Hiring Panel\n\nCognitive Assessment via a platform called Xobin - It’s a 50-minute assessment, which is a mandatory step in our recruitment process for all roles.\n\nPanel Discussions - Typically a minimum of three rounds","description_format":"text","description_chars":5181,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":2,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Threat Intelligence","Information Security","Cybersecurity AI"],"lifecycle":[{"event":"open","at":"2026-09-05T13:45:40Z"}],"visa":[],"liveness":{"score":28,"band":"fade","label":"Fading","p_open":1,"p_active":0.625,"p_room":0.45,"age_days":49,"expected_fill_days":33,"reasons":["conf:2","win:tail"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":25000,"is_top_pay":false},"html_url":"https://alion.io/job/cyble-ai-soc-lead","json_url":"https://alion.io/job/cyble-ai-soc-lead.json","meta":{"generated_at":"2026-10-26T05:45:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7635,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2698},"rest":"https://alion.io/mcp/rest/get_company?id=2698"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyble-ai-soc-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyble-ai-soc-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyble-ai-soc-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyble-ai-soc-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyble-ai-soc-lead"}]}