{"id":1227924,"url":"https://alion.io/job/employee-forums-security-operations-center-lead","title":"Security Operations Center Lead","company":{"id":3800192,"name":"Employee Forums","domain":"employeeforums.com","url":"https://alion.io/company/employee-forums","size_band":null,"is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mumbai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":2700000,"max":3000000,"currency":"INR","period":"year","gross":true,"usd_annual":31446},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Google SecOps","optional":false},{"name":"IAM","optional":false},{"name":"IBM QRadar","optional":false},{"name":"ITSM","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-09-22T11:42:02Z","employer_posted_date":null,"last_verified_at":"2026-09-22T11:42:02Z","board_verified":false,"closed_at":null,"days_open":22,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":22},"description":"Role : Security Operations Center (SOC) Lead\n\nDepartment : Cyber Operations & Engineering\n\nLocation : Mumbai\n\nExperience Required : 8 - 10 Years\n\nReporting To : Head of Cybersecurity / CISO\n\nRole Summary : \n\nThe SOC Lead oversees 24x7 security operations, advanced detection engineering, and high-severity incident response. This role combines technical leadership across SIEM, SOAR, and EDR platforms with operational governance - mentoring Tier-1 and Tier-2 analysts, optimizing runbooks, and ensuring swift threat containment across enterprise environments.\n\nKey Responsibilities : \n\n- Incident Response & Escalations : Serve as the final escalation point for critical (P1/P2) security incidents; direct end-to-end containment, eradication, forensics, and post-incident root cause analysis (RCA).\n\n- Detection Engineering & Tuning : Oversee SIEM correlation rule creation, use-case mapping to the MITRE ATT&CK framework, and alert tuning to eliminate noise and reduce false positives.\n\n- SOAR & Automation : Direct the development of automated incident response playbooks integrated with EDR, firewalls, IAM, and ITSM to consistently lower MTTR and MTTD.\n\n- Threat Hunting & Intelligence : Integrate actionable threat intelligence (CTI) into monitoring workflows and guide proactive threat-hunting exercises across network, endpoint, and cloud assets.\n\n- Operational Governance & Mentorship : Manage analyst shift rotations, define SOC SOPs and runbooks, conduct tabletop simulations, and mentor Tier-1 and Tier-2 engineers.\n\n- Metrics & Executive Reporting : Track and report core operational KPIs (MTTD, MTTR, coverage gaps) and present threat summaries and security posture updates to executive leadership and audit teams.\n\nRequired Technical Skills & Qualifications : \n\n- Experience : 8 - 10 years in cyber operations, with at least 3+ years in a senior, L3, or lead capacity within an enterprise SOC or MSSP.\n\n- SIEM/SOAR Expertise : Deep architectural and operational mastery of modern SIEM platforms (e.g., Microsoft Sentinel, Splunk, QRadar, Google SecOps) and SOAR tools (e.g., Cortex XSOAR, Splunk SOAR).\n\n- Threat Detection : Proven ability to map detections to MITRE ATT&CK, investigate complex lateral movement, and analyze advanced attack vectors (ransomware, living-off-the-land techniques).\n\n- Scripting & Telemetry : Hands-on experience analyzing endpoint telemetry (CrowdStrike, Defender, SentinelOne), network logs, and identity systems; working knowledge of Python, PowerShell, or KQL for log query optimization and automation.\n\n- Leadership : Strong track record in team coaching, crisis decision-making, and stakeholder communication.\n\nPreferred Certifications : \n\n- CISSP, CISM, or CCISO\n\n- GIAC Certifications (GCIH, GCFA, GCED, or GNFA)\n\n- Certified SIEM/SOAR Architect (e.g., Splunk Certified Enterprise Security Admin, Microsoft Sentinel SC-200)\nSkills\nCyber Security, Security Operations Center, SIEM, SOAR, Threat Detection, Azure Sentinel, CISSP, CISM","description_format":"text","description_chars":2984,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations"],"lifecycle":[{"event":"open","at":"2026-09-25T13:06:44Z"}],"visa":[],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":0.85,"p_active":0.467,"p_room":0.75,"age_days":21,"expected_fill_days":23,"reasons":["seen:21","agency","velocity","win:late"],"computed_at":"2026-10-14T06:34:16Z"},"pay":{"stated_usd_annual":31446,"is_top_pay":false},"html_url":"https://alion.io/job/employee-forums-security-operations-center-lead","json_url":"https://alion.io/job/employee-forums-security-operations-center-lead.json","meta":{"generated_at":"2026-10-14T22:02:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29558,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3800192},"rest":"https://alion.io/mcp/rest/get_company?id=3800192"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Femployee-forums-security-operations-center-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Femployee-forums-security-operations-center-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Femployee-forums-security-operations-center-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/employee-forums-security-operations-center-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Femployee-forums-security-operations-center-lead"}]}