Cyber Security Services (CSS) Team Lead
Confirmed on the employer's own hiring board on Nov 13, 2026. First seen by Alion on Nov 12, 2026.
We are looking for a CSS Team Lead to join our Cyber Security Services (CSS) Tower and take ownership of one of our Security Operations Center delivery teams (24x7, dedicated or shared resources, depending on project assignment).
As a CSS Team Lead, you sit at the intersection of people management, technical coordination and client engagement. You are the Single Point of Contact (SPOC) for your assigned accounts, and you own the day-to-day performance of your team, from shift coverage and SLA adherence to career development and client reporting. You lead a team that works alongside modern SIEM, EDR/XDR, SOAR and AI-assisted triage tooling, and you are expected to know where automation should be trusted and where human judgement, yours and your team's, still has to make the call.
This is a hands-on leadership role: you are close enough to the operational details to unblock your analysts and speak credibly to a client's technical stakeholders, while also owning the administrative and strategic side of running a delivery team.
The services delivered within the team span Security Monitoring, Detection & Response, Platform Management and Phishing Response.
Job responsibilities:
People Management
- Act as mentor, adviser and leader for your cyber security team, providing direction, coaching and support across shifts.
- Own the administrative backbone of the team: schedules, timesheets, availability, 1:1s, career-path guidance, performance reviews and team objectives.
- Support team growth and skills development, including readiness to work effectively alongside AI-assisted tools.
- Act as back-up to other people managers within the CSS SOC team, ensuring continuity of leadership across the tower.
- Work closely with adjacent business functions to keep communication and updates flowing to the team.
Client Engagement & Technical Coordination
- Act as the SPOC and the bridge between the CSS SOC team and the customer's technical stakeholders, ensuring smooth, accurate communication in both directions.
- Understand and translate client technical requirements into actionable directions for the CSS SOC team.
- Lead weekly/monthly technical and service-review meetings with clients on the security scope and produce the associated reporting; align with the Service Manager or Delivery Account Manager where the account requires a consolidated, cross-service view.
- Coordinate with internal teams (including peer Team Leads) to schedule, plan and deliver technical services, recommendations and documentation (KBAs, SOPs, runbooks).
- Align technical execution with client strategic objectives and compliance obligations (e.g. NIS2, DORA reporting timelines) where applicable to the account, flagging any cross-service dependencies to the Service Manager or Delivery Account Manager.
Incident Management
- Own the handling of security incidents end-to-end within the security service scope, ensuring rapid, clear communication to all stakeholders, including during out-of-hours escalations, and keeping the Service Manager or Delivery Account Manager informed on incidents with wider account impact, where applicable.
- Coordinate resources during incidents to streamline investigation, containment and resolution.
- Own the quality of incident documentation, timelines and post-incident reports, ensuring they meet the standard required for internal review and, where relevant, client regulatory reporting.
- Own lessons-learned follow-through: ensure gaps identified in an incident (detection, process, tooling) are tracked to closure, escalating gaps that extend beyond security services to the Service Manager or Delivery Account Manager.
Service Delivery Support
- Own service delivery performance for the security services scope: monitor SLAs and KPIs and ensure the team consistently meets or exceeds them.
- Collaborate with the SOC Manager on team performance, and with the Service Manager or Delivery Account Manager where applicable, who holds overall accountability for the account across all service towers, on account-level trends and reporting.
- Oversee how AI-assisted and automated tooling is used within the team's workflows, balancing efficiency gains against the need for human oversight and quality control.
- Prepare and present regular performance and service delivery reports on the security scope to clients and internal stakeholders, feeding into the Service Managers or Delivery Account Managers consolidated account reporting where applicable.
- Be proactive: propose new solutions, challenge existing processes, and drive operational maturity within the security service, raising cross-service opportunities to the Service Manager or Delivery Account Manager.
Education:
- Bachelor's degree in a relevant field (e.g. Information Technology, Computer Science, Business Administration, Communications) or equivalent professional experience.
Experience:
- A minimum of 2 years of experience leading cybersecurity operations teams.
- Experience demonstrating leadership, stakeholder management, and operational coordination capabilities is required.
- A technical background gained through previous hands-on roles is highly valued, as it provides the foundation needed to quickly build expertise in security operations, incident management, risk-based decision-making, and cybersecurity best practices within a SOC environment.
Mandatory technical skills:
- Solid IT fundamentals: networking (TCP/IP, DNS, routing/switching basics), Windows and/or Linux server administration, and familiarity with cloud platforms (Azure, AWS or GCP) the operational grounding that security monitoring sits on top of.
- Exposure to service management frameworks (ITIL) and experience owning SLA/KPI reporting for external clients.
- Basic knowledge of security best practices and frameworks (e.g. MITRE ATT&CK, NIST CSF, ISO/IEC 27001) and how they translate into day-to-day operations.
- Understanding of relevant regulatory and compliance drivers affecting clients (e.g. NIS2, DORA, GDPR) and their incident-reporting implications.
- Comfort working with ticketing, monitoring or ITSM tooling; direct exposure to SIEM/EDR/XDR/SOAR is a plus.
- General awareness of how AI-assisted monitoring, triage and automation tooling is changing operational workflows, enough to evaluate where they help and where they need human review.
Professional skills:
- Customer-oriented attitude with strong communication and presentation skills.
- Conflict-resolution skills and the ability to manage competing priorities across shifts, teams and clients.
- People-oriented, problem-solver mindset with a strategic outlook, able to think critically and make data-driven decisions.
- Ability to lead under pressure, coordinate multiple technical owners, and drive recovery to closure.
- Ability to work collaboratively across cross-functional teams (peer Team Leads, SOC Manager, Service Manager or Delivery Account Manager, business functions).
- A commitment to continuous learning and improvement, staying abreast of cyber security industry best practices, emerging technologies, and methodologies.
- Personal and professional integrity, with a high standard of work ethics.
Language proficiency:
- Excellent English communication skills, both verbal and written, for professional communication and documentation.
Desired qualifications (not mandatory):
- Relevant professional certifications in Cybersecurity, IT and/or Management (e.g. CompTIA Security+/CySA+, ITIL, PMP, or people-management certifications).
- Prior experience managing or coordinating 24x7 rotating-shift teams.
- Familiarity with AI governance or human-in-the-loop oversight practices for security tooling.
What This Role Offers You:
- Ownership of a full-scope SOC delivery team, technical, operational, and client-facing, within a growing Cyber Security Services tower.
- Direct exposure to strategic client relationships and to the design of how AI-augmented security operations are run in practice, working alongside the TSMO on accounts with a cross-service footprint.
- A clear path to grow into broader service management or security leadership roles (e.g., SOC Manager) as the CSS Tower scales.
- A collaborative leadership group built around mutual back-up and shared standards, rather than siloed ownership.
- A defined career development pathway within the CSS Tower and broader Stefanini security practice.
- Support for professional certifications and continuous learning in the cybersecurity domain.
- A collaborative team environment that values your existing experience and invests in your growth.
This job description outlines the general nature and level of work performed by employees within this classification and is not intended to be a comprehensive inventory of all duties and responsibilities. Additionally, the responsibility to possess the necessary employment documents for this country rests with the candidate.
What we offer
You will find here not only an environment where you can do meaningful work and feel supported, but also a benefits package designed to foster your growth and wellbeing:
- Soft skills and technical training for current and emerging products and technologies;
- Mentoring programs that connect you with mentors from around the world;
- Employee Assistance Programs to support your wellbeing, both personally and professionally;
- Career development opportunities to grow within the team;
- Special referral bonuses for recommending friends;
- A friendly team eager to welcome you.
About us
Stefanini is a Brazilian multinational company with 39 years of experience and presence in 41 countries. With more than 35,000 employees, we co-create solutions for a better future, driving digital transformation with a focus on real results.
We operate in an integrated way through 7 specialized business units: Consulting (Technology and Business Agility), Analytics & AI, Banking & Payments, Cybersecurity, Manufacturing 4.0, and Digital Marketing. We are a group that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
If you are looking for a place to develop, innovate, and be part of something bigger, then Stefanini is your place.
Our commitment to inclusion and fairness
At Stefanini, we are fostering a workplace where it is safe to express oneself, and everyone is treated with dignity, respect, and fairness. We welcome people of all backgrounds, regardless of race, ethnicity, color, nationality, gender, gender identity or expression, sexual orientation, age, religion, belief, and disability.
Every individual is encouraged to be their authentic self, as diverse perspectives strengthen our teams, drive innovation, and contribute to our success.
Our recruitment process is designed to be fair, consistent, and inclusive. We act in a transparent and fair manner in our employment practices, ensuring that all employees receive equitable compensation for their contributions, regardless of their background.
What's next:
It's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at [email protected] and we'll be happy to assist!
Education:
- Bachelor's degree in a relevant field (e.g. Information Technology, Computer Science, Business Administration, Communications) or equivalent professional experience.
Experience:
- A minimum of 2 years of experience leading cybersecurity operations teams.
- Experience demonstrating leadership, stakeholder management, and operational coordination capabilities is required.
- A technical background gained through previous hands-on roles is highly valued, as it provides the foundation needed to quickly build expertise in security operations, incident management, risk-based decision-making, and cybersecurity best practices within a SOC environment.
Mandatory technical skills:
- Solid IT fundamentals: networking (TCP/IP, DNS, routing/switching basics), Windows and/or Linux server administration, and familiarity with cloud platforms (Azure, AWS or GCP) the operational grounding that security monitoring sits on top of.
- Exposure to service management frameworks (ITIL) and experience owning SLA/KPI reporting for external clients.
- Basic knowledge of security best practices and frameworks (e.g. MITRE ATT&CK, NIST CSF, ISO/IEC 27001) and how they translate into day-to-day operations.
- Understanding of relevant regulatory and compliance drivers affecting clients (e.g. NIS2, DORA, GDPR) and their incident-reporting implications.
- Comfort working with ticketing, monitoring or ITSM tooling; direct exposure to SIEM/EDR/XDR/SOAR is a plus.
- General awareness of how AI-assisted monitoring, triage and automation tooling is changing operational workflows, enough to evaluate where they help and where they need human review.
Professional skills:
- Customer-oriented attitude with strong communication and presentation skills.
- Conflict-resolution skills and the ability to manage competing priorities across shifts, teams and clients.
- People-oriented, problem-solver mindset with a strategic outlook, able to think critically and make data-driven decisions.
- Ability to lead under pressure, coordinate multiple technical owners, and drive recovery to closure.
- Ability to work collaboratively across cross-functional teams (peer Team Leads, SOC Manager, Service Manager or Delivery Account Manager, business functions).
- A commitment to continuous learning and improvement, staying abreast of cyber security industry best practices, emerging technologies, and methodologies.
- Personal and professional integrity, with a high standard of work ethics.
Language proficiency:
- Excellent English communication skills, both verbal and written, for professional communication and documentation.
Desired qualifications (not mandatory):
- Relevant professional certifications in Cybersecurity, IT and/or Management (e.g. CompTIA Security+/CySA+, ITIL, PMP, or people-management certifications).
- Prior experience managing or coordinating 24x7 rotating-shift teams.
- Familiarity with AI governance or human-in-the-loop oversight practices for security tooling.
What This Role Offers You:
- Ownership of a full-scope SOC delivery team, technical, operational, and client-facing, within a growing Cyber Security Services tower.
- Direct exposure to strategic client relationships and to the design of how AI-augmented security operations are run in practice, working alongside the TSMO on accounts with a cross-service footprint.
- A clear path to grow into broader service management or security leadership roles (e.g., SOC Manager) as the CSS Tower scales.
- A collaborative leadership group built around mutual back-up and shared standards, rather than siloed ownership.
- A defined career development pathway within the CSS Tower and broader Stefanini security practice.
- Support for professional certifications and continuous learning in the cybersecurity domain.
- A collaborative team environment that values your existing experience and invests in your growth.
This job description outlines the general nature and level of work performed by employees within this classification and is not intended to be a comprehensive inventory of all duties and responsibilities. Additionally, the responsibility to possess the necessary employment documents for this country rests with the candidate.
What we offer
You will find here not only an environment where you can do meaningful work and feel supported, but also a benefits package designed to foster your growth and wellbeing:
- Soft skills and technical training for current and emerging products and technologies;
- Mentoring programs that connect you with mentors from around the world;
- Employee Assistance Programs to support your wellbeing, both personally and professionally;
- Career development opportunities to grow within the team;
- Special referral bonuses for recommending friends;
- A friendly team eager to welcome you.
About us
Stefanini is a Brazilian multinational company with 39 years of experience and presence in 41 countries. With more than 35,000 employees, we co-create solutions for a better future, driving digital transformation with a focus on real results.
We operate in an integrated way through 7 specialized business units: Consulting (Technology and Business Agility), Analytics & AI, Banking & Payments, Cybersecurity, Manufacturing 4.0, and Digital Marketing. We are a group that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
If you are looking for a place to develop, innovate, and be part of something bigger, then Stefanini is your place.
Our commitment to inclusion and fairness
At Stefanini, we are fostering a workplace where it is safe to express oneself, and everyone is treated with dignity, respect, and fairness. We welcome people of all backgrounds, regardless of race, ethnicity, color, nationality, gender, gender identity or expression, sexual orientation, age, religion, belief, and disability.
Every individual is encouraged to be their authentic self, as diverse perspectives strengthen our teams, drive innovation, and contribute to our success.
Our recruitment process is designed to be fair, consistent, and inclusive. We act in a transparent and fair manner in our employment practices, ensuring that all employees receive equitable compensation for their contributions, regardless of their background.
What's next:
It's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at [email protected] and we'll be happy to assist!