{"id":4170064,"url":"https://alion.io/job/stefanini-emea-cyber-security-services-css-team-lead","title":"Cyber Security Services (CSS) Team Lead","company":{"id":4425653,"name":"Stefanini EMEA","domain":"stefanini.ro","url":"https://alion.io/company/stefanini-ro","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartSearch","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Moldova","Poland","Romania"],"countries":["MD","PL","RO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"Incident Management","optional":false},{"name":"ITIL","optional":false},{"name":"ITSM","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Human-in-the-Loop","optional":true},{"name":"Outlook","optional":true}],"status":"live","first_seen_at":"2026-11-12T12:00:00Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-13T10:29:21Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"We are looking for a CSS Team Lead to join our Cyber Security Services (CSS) Tower and take ownership of one of our Security Operations Center delivery teams (24x7, dedicated or shared resources, depending on project assignment).\nAs a CSS Team Lead, you sit at the intersection of people management, technical coordination and client engagement. You are the Single Point of Contact (SPOC) for your assigned accounts, and you own the day-to-day performance of your team, from shift coverage and SLA adherence to career development and client reporting. You lead a team that works alongside modern SIEM, EDR/XDR, SOAR and AI-assisted triage tooling, and you are expected to know where automation should be trusted and where human judgement, yours and your team's, still has to make the call.\nThis is a hands-on leadership role: you are close enough to the operational details to unblock your analysts and speak credibly to a client's technical stakeholders, while also owning the administrative and strategic side of running a delivery team.\nThe services delivered within the team span Security Monitoring, Detection & Response, Platform Management and Phishing Response.\nJob responsibilities:\nPeople Management\nAct as mentor, adviser and leader for your cyber security team, providing direction, coaching and support across shifts.\nOwn the administrative backbone of the team: schedules, timesheets, availability, 1:1s, career-path guidance, performance reviews and team objectives.\nSupport team growth and skills development, including readiness to work effectively alongside AI-assisted tools.\nAct as back-up to other people managers within the CSS SOC team, ensuring continuity of leadership across the tower.\nWork closely with adjacent business functions to keep communication and updates flowing to the team.\nClient Engagement & Technical Coordination\nAct as the SPOC and the bridge between the CSS SOC team and the customer's technical stakeholders, ensuring smooth, accurate communication in both directions.\nUnderstand and translate client technical requirements into actionable directions for the CSS SOC team.\nLead weekly/monthly technical and service-review meetings with clients on the security scope and produce the associated reporting; align with the Service Manager or Delivery Account Manager where the account requires a consolidated, cross-service view.\nCoordinate with internal teams (including peer Team Leads) to schedule, plan and deliver technical services, recommendations and documentation (KBAs, SOPs, runbooks).\nAlign technical execution with client strategic objectives and compliance obligations (e.g. NIS2, DORA reporting timelines) where applicable to the account, flagging any cross-service dependencies to the Service Manager or Delivery Account Manager.\nIncident Management\nOwn the handling of security incidents end-to-end within the security service scope, ensuring rapid, clear communication to all stakeholders, including during out-of-hours escalations, and keeping the Service Manager or Delivery Account Manager informed on incidents with wider account impact, where applicable. \nCoordinate resources during incidents to streamline investigation, containment and resolution. \nOwn the quality of incident documentation, timelines and post-incident reports, ensuring they meet the standard required for internal review and, where relevant, client regulatory reporting. \nOwn lessons-learned follow-through: ensure gaps identified in an incident (detection, process, tooling) are tracked to closure, escalating gaps that extend beyond security services to the Service Manager or Delivery Account Manager.\nService Delivery Support\nOwn service delivery performance for the security services scope: monitor SLAs and KPIs and ensure the team consistently meets or exceeds them.\nCollaborate with the SOC Manager on team performance, and with the Service Manager or Delivery Account Manager where applicable, who holds overall accountability for the account across all service towers, on account-level trends and reporting.\nOversee how AI-assisted and automated tooling is used within the team's workflows, balancing efficiency gains against the need for human oversight and quality control.\nPrepare and present regular performance and service delivery reports on the security scope to clients and internal stakeholders, feeding into the Service Managers or Delivery Account Managers consolidated account reporting where applicable.\nBe proactive: propose new solutions, challenge existing processes, and drive operational maturity within the security service, raising cross-service opportunities to the Service Manager or Delivery Account Manager.\nEducation:\nBachelor's degree in a relevant field (e.g. Information Technology, Computer Science, Business Administration, Communications) or equivalent professional experience.\nExperience:\nA minimum of 2 years of experience leading cybersecurity operations teams.\nExperience demonstrating leadership, stakeholder management, and operational coordination capabilities is required.\nA technical background gained through previous hands-on roles is highly valued, as it provides the foundation needed to quickly build expertise in security operations, incident management, risk-based decision-making, and cybersecurity best practices within a SOC environment.\nMandatory technical skills:\nSolid IT fundamentals: networking (TCP/IP, DNS, routing/switching basics), Windows and/or Linux server administration, and familiarity with cloud platforms (Azure, AWS or GCP) the operational grounding that security monitoring sits on top of. \nExposure to service management frameworks (ITIL) and experience owning SLA/KPI reporting for external clients. \nBasic knowledge of security best practices and frameworks (e.g. MITRE ATT&CK, NIST CSF, ISO/IEC 27001) and how they translate into day-to-day operations.\nUnderstanding of relevant regulatory and compliance drivers affecting clients (e.g. NIS2, DORA, GDPR) and their incident-reporting implications.\nComfort working with ticketing, monitoring or ITSM tooling; direct exposure to SIEM/EDR/XDR/SOAR is a plus.\nGeneral awareness of how AI-assisted monitoring, triage and automation tooling is changing operational workflows, enough to evaluate where they help and where they need human review. \nProfessional skills:\nCustomer-oriented attitude with strong communication and presentation skills. \nConflict-resolution skills and the ability to manage competing priorities across shifts, teams and clients. \nPeople-oriented, problem-solver mindset with a strategic outlook, able to think critically and make data-driven decisions.\nAbility to lead under pressure, coordinate multiple technical owners, and drive recovery to closure.\nAbility to work collaboratively across cross-functional teams (peer Team Leads, SOC Manager, Service Manager or Delivery Account Manager, business functions). \nA commitment to continuous learning and improvement, staying abreast of cyber security industry best practices, emerging technologies, and methodologies.\nPersonal and professional integrity, with a high standard of work ethics.\nLanguage proficiency:\nExcellent English communication skills, both verbal and written, for professional communication and documentation.\nDesired qualifications (not mandatory):\nRelevant professional certifications in Cybersecurity, IT and/or Management (e.g. CompTIA Security+/CySA+, ITIL, PMP, or people-management certifications). \nPrior experience managing or coordinating 24x7 rotating-shift teams. \nFamiliarity with AI governance or human-in-the-loop oversight practices for security tooling.\nWhat This Role Offers You:\nOwnership of a full-scope SOC delivery team, technical, operational, and client-facing, within a growing Cyber Security Services tower.\nDirect exposure to strategic client relationships and to the design of how AI-augmented security operations are run in practice, working alongside the TSMO on accounts with a cross-service footprint. \nA clear path to grow into broader service management or security leadership roles (e.g., SOC Manager) as the CSS Tower scales. \nA collaborative leadership group built around mutual back-up and shared standards, rather than siloed ownership.\nA defined career development pathway within the CSS Tower and broader Stefanini security practice.\nSupport for professional certifications and continuous learning in the cybersecurity domain.\nA collaborative team environment that values your existing experience and invests in your growth.\nThis job description outlines the general nature and level of work performed by employees within this classification and is not intended to be a comprehensive inventory of all duties and responsibilities. Additionally, the responsibility to possess the necessary employment documents for this country rests with the candidate.\nWhat we offer\nYou will find here not only an environment where you can do meaningful work and feel supported, but also a benefits package designed to foster your growth and wellbeing:\nSoft skills and technical training for current and emerging products and technologies;\nMentoring programs that connect you with mentors from around the world;\nEmployee Assistance Programs to support your wellbeing, both personally and professionally;\nCareer development opportunities to grow within the team;\nSpecial referral bonuses for recommending friends;\nA friendly team eager to welcome you.\nAbout us\nStefanini is a Brazilian multinational company with 39 years of experience and presence in 41 countries. With more than 35,000 employees, we co-create solutions for a better future, driving digital transformation with a focus on real results.\nWe operate in an integrated way through 7 specialized business units: Consulting (Technology and Business Agility), Analytics & AI, Banking & Payments, Cybersecurity, Manufacturing 4.0, and Digital Marketing. We are a group that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.\nIf you are looking for a place to develop, innovate, and be part of something bigger, then Stefanini is your place.\nOur commitment to inclusion and fairness\nAt Stefanini, we are fostering a workplace where it is safe to express oneself, and everyone is treated with dignity, respect, and fairness. We welcome people of all backgrounds, regardless of race, ethnicity, color, nationality, gender, gender identity or expression, sexual orientation, age, religion, belief, and disability.\nEvery individual is encouraged to be their authentic self, as diverse perspectives strengthen our teams, drive innovation, and contribute to our success.\nOur recruitment process is designed to be fair, consistent, and inclusive. We act in a transparent and fair manner in our employment practices, ensuring that all employees receive equitable compensation for their contributions, regardless of their background.\nWhat's next:\nIt's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at  and we'll be happy to assist!\nEducation:\nBachelor's degree in a relevant field (e.g. Information Technology, Computer Science, Business Administration, Communications) or equivalent professional experience.\nExperience:\nA minimum of 2 years of experience leading cybersecurity operations teams.\nExperience demonstrating leadership, stakeholder management, and operational coordination capabilities is required.\nA technical background gained through previous hands-on roles is highly valued, as it provides the foundation needed to quickly build expertise in security operations, incident management, risk-based decision-making, and cybersecurity best practices within a SOC environment.\nMandatory technical skills:\nSolid IT fundamentals: networking (TCP/IP, DNS, routing/switching basics), Windows a...","description_format":"text","description_chars":17784,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":2,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Continuous learning","Mentoring programs"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Managed Security","IT Consulting & Digital Transformation"],"lifecycle":[{"event":"open","at":"2026-11-12T14:29:52Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":25,"reasons":["conf:2","win:early"],"computed_at":"2026-11-13T13:07:22Z"},"pay":null,"html_url":"https://alion.io/job/stefanini-emea-cyber-security-services-css-team-lead","json_url":"https://alion.io/job/stefanini-emea-cyber-security-services-css-team-lead.json","meta":{"generated_at":"2026-11-13T13:07:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26284,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4425653},"rest":"https://alion.io/mcp/rest/get_company?id=4425653"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstefanini-emea-cyber-security-services-css-team-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstefanini-emea-cyber-security-services-css-team-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstefanini-emea-cyber-security-services-css-team-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/stefanini-emea-cyber-security-services-css-team-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstefanini-emea-cyber-security-services-css-team-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4170064}},{"tool":"search_jobs","arguments":{"company":"stefanini.ro","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4170064},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}