{"id":2776282,"url":"https://alion.io/job/socroom-soc-team-lead-managed-security-services","title":"SOC Team Lead Managed Security Services","company":{"id":4444049,"name":"socroom","domain":"socroom.com","url":"https://alion.io/company/socroom","size_band":null,"is_staffing_agency":false,"employer_type":"staffing","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":30000,"max_usd":79000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":33},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Wazuh","optional":false},{"name":"Windows","optional":false},{"name":"Crowdstrike","optional":true},{"name":"IBM QRadar","optional":true},{"name":"ISO 27001","optional":true},{"name":"NIST CSF","optional":true},{"name":"PCI DSS","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true},{"name":"SIEM","optional":true},{"name":"SOC 2","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-10-08T17:38:50Z","employer_posted_date":null,"last_verified_at":"2026-10-08T17:38:50Z","board_verified":false,"closed_at":null,"days_open":13,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":13},"description":"Company Description\nSOCRoom by Procain consulting, helps businesses strengthen security operations with continuous monitoring, faster response, and expert SOC support.\n\nWe work with organisations that need better visibility, alert handling, incident response, and security operations coverage without building a full SOC in-house.\n\nOur services include Managed SOC, SOC as a Service, SOC Staff Augmentation, Cloud Security Monitoring, threat detection, alert triage, and incident response support.\n\nBuilt on the principle of Detect. Prevent. Prevail., SOCRoom by Procain consulting, helps teams move from security alerts to real action - faster, sharper, and with greater operational confidence.\n\nKey responsibilities\n\nTeam leadership and shift operations\nLead, mentor and schedule a team of L1/L2 analysts to maintain 24x7 coverage and consistent \nservice quality.\nOwn shift handovers, ensuring every open incident transfers with current status, next action and \nowner.\nConduct quality reviews of closed incidents, verifying verdicts (true positive, benign positive, \nfalse positive) and documentation.\nCoach analysts on investigation methodology, KQL and tooling; drive onboarding and structured \nskills development.\n\nIncident detection and response\nAct as the escalation point for high-severity incidents, including lateral movement, privileged \naccount compromise and data exfiltration.\nDirect investigations from initial alert through entity analysis, timeline reconstruction, \ncontainment and closure.\nCoordinate containment actions with customer IT and security teams, and with L3 / incident \nresponse specialists where needed.\nLead post-incident reviews and translate lessons learned into detection and process \nimprovements.\n\nMicrosoft Sentinel platform ownership\nOversee analytics rule lifecycle: design, testing, tuning, alert grouping, suppression and \nretirement of noisy rules.\nDevelop and review KQL queries, hunting queries, workbooks and watchlists.\nGuide automation using playbooks (Logic Apps) and automation rules to reduce manual triage \neffort.\nWork with engineering teams on data connector onboarding, log source health and ingestion \ncost optimization.\n\nWazuh operations (where deployed)\nSupervise monitoring of Wazuh-managed customer environments, including agent health, rule \nand decoder tuning, and alert triage.\nSupport integration of Wazuh alerts into central SOC workflows and ticketing.\n\nCustomer engagement and reporting\nServe as a technical point of contact for customers during incidents and in regular service \nreviews.\nProduce monthly SOC reports covering incident trends, SLA performance, detection coverage \nand recommendations.\nEnsure adherence to contractual SLAs for time-to-triage, time-to-escalate and time-to-notify.\nMaintain and improve runbooks, escalation matrices and standard operating procedures.\n\nRequired qualifications (mandatory)\nBachelor's degree in Computer Science, Information Security or a related field, or equivalent professional experience.\n5+ years of experience in a SOC, MSSP or MDR environment, including at least 1–2 years leading or mentoring analysts.\nHands-on experience with Microsoft Sentinel (minimum 2 years in production), covering analytics rules, incidents, entity investigation, workbooks, watchlists, UEBA and playbooks.\nStrong proficiency in KQL for detection engineering, threat hunting and investigation.\nWorking knowledge of the Microsoft security ecosystem: Defender XDR (Endpoint, Identity, Office 365, Cloud Apps), Entra ID and Azure activity logs.\nSolid understanding of the incident response lifecycle, the MITRE ATT&CK framework and common attack techniques.\nGood knowledge of networking, Windows and Linux internals, Active Directory and cloud security fundamentals.\nExperience working to customer SLAs in a multi-tenant or managed services environment.\nExcellent written and verbal communication skills, including incident reporting to technical and executive audiences.\nWillingness to work in a 24x7 rotational environment and to be available for on-call escalations.\n\nPreferred qualifications\nHands-on experience with Wazuh: agent deployment, custom rules and decoders, active response, file integrity monitoring and vulnerability detection.\nMicrosoft certifications such as SC-200 (Security Operations Analyst), AZ-500 or SC-100.\nIndustry certifications such as GCIH, GCIA, CySA+, BTL1/BTL2, or equivalent incident response credentials.\nExperience with other SIEM/SOAR platforms (Splunk, QRadar, Elastic) and EDR tools (CrowdStrike, SentinelOne).\nScripting skills in PowerShell or Python for automation and enrichment.\nExposure to threat intelligence platforms, threat hunting programs and detection-as-code practices.\nFamiliarity with compliance frameworks such as ISO 27001, SOC 2, PCI DSS or NIST CSF.\n\nKey competencies\nLeadership: builds a motivated, accountable team and develops analysts into senior contributors.\nAnalytical judgment: makes sound, timely decisions under pressure with incomplete information.\nCustomer focus: communicates clearly and calmly with customers during active incidents.\nContinuous improvement: uses data to reduce false positives, improve detection coverage and streamline workflows.","description_format":"text","description_chars":5211,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-17T07:43:17Z"}],"visa":[],"liveness":{"score":73,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.815,"p_room":0.9,"age_days":12,"expected_fill_days":26,"reasons":["seen:12","win:mid"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/socroom-soc-team-lead-managed-security-services","json_url":"https://alion.io/job/socroom-soc-team-lead-managed-security-services.json","meta":{"generated_at":"2026-10-22T04:09:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4374,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4444049},"rest":"https://alion.io/mcp/rest/get_company?id=4444049"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsocroom-soc-team-lead-managed-security-services"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsocroom-soc-team-lead-managed-security-services"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsocroom-soc-team-lead-managed-security-services"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/socroom-soc-team-lead-managed-security-services\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsocroom-soc-team-lead-managed-security-services"}]}