{"id":2566714,"url":"https://alion.io/job/ufp-industries-lead-soc-analyst","title":"Lead SOC Analyst","company":{"id":2197721,"name":"UFP Industries","domain":"ufpi.com","url":"https://alion.io/company/ufpi-com","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":28,"ghost_share":0,"stale_share":0.964,"repost_share":0,"time_to_fill_p50_days":18,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Grand Rapids, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":98000,"max_usd":203000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":398},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Microsoft Sentinel","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-10-14T22:02:26Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-25T08:20:04Z","board_verified":true,"closed_at":null,"days_open":10,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":10},"description":"Job Summary\nThe Lead SOC Analyst is responsible for leading the daily operations of the Security Operations Center (SOC) while actively participating in threat detection, investigation, and response activities. This role operates in a player/coach capacity, balancing hands-on incident response with team leadership, process development, and SOC maturity initiatives.\nThe Lead SOC Analyst serves as the primary point of coordination between the internal SOC and external managed detection and response (MDR) provider, ensuring effective monitoring, escalation, and response to security events. This role is also responsible for developing and maintaining SOC processes, playbooks, and documentation to improve the organization’s overall security posture.\nThis role reports to the Manager of Cyber Defense.\nLocation: this role must work on-site, full-time out of our Grand Rapids, MI office\nPrincipal Duties and Responsibilities\nSOC Operations and Incident Response\nAct as the senior escalation point for security incidents, providing hands-on investigation and response.\nPerform advanced threat hunting, incident analysis, and root cause determination.\nLead and coordinate incident response activities across IT, infrastructure, and application teams.\nValidate and enrich alerts generated by internal tools and external MDR provider.\nEnsure timely containment, remediation, and closure of security incidents.\nMDR Vendor Management\nServe as the primary operational liaison with our MDR provider.\nManage day-to-day interactions including alert triage alignment, escalation handling, and service quality.\nReview MDR detections, investigations, and recommendations for accuracy and relevance.\nIdentify and drive improvements in detection coverage, alert fidelity, and response processes.\nParticipate in regular service reviews and ensure deliverables meet organizational expectations.\nSOC Leadership and Team Development\nProvide technical leadership and guidance to SOC analysts.\nLead daily SOC operations including prioritization of alerts, workload management, and escalation decisions.\nMentor and develop analysts through coaching, training, and knowledge sharing.\nEstablish expectations for investigation quality, documentation, and response timelines.\nSupport hiring, onboarding, and skill development of SOC team members.\nSOC Maturity and Process Development\nDevelop, document, and maintain SOC standard operating procedures (SOPs), playbooks, and runbooks.\nIdentify gaps in SOC processes and implement improvements to increase consistency and effectiveness.\nDefine and track SOC metrics and KPIs (e.g., MTTR, alert volume, false positives, escalation rates).\nStandardize incident documentation and evidence collection to support audit and compliance requirements.\nDrive continuous improvement initiatives aligned to industry best practices and organizational goals.\nDetection Engineering and Monitoring\nCollaborate with engineering and security teams to improve detection logic and use cases.\nDevelop and tune detection rules within SIEM, XDR, and MDR platforms.\nIdentify gaps in logging and telemetry and work with teams to onboard required data sources.\nEnsure monitoring coverage for systems handling sensitive or critical data.\nContribute to threat modeling and detection strategy development.\nCommunication and Stakeholder Engagement\nCommunicate security incidents, risks, and trends to technical and non-technical stakeholders.\nProvide clear and concise reporting on incident outcomes and lessons learned.\nPartner with infrastructure, application, and business teams to improve security practices.\nSupport audit, compliance, and risk management activities as needed.\nQualifications\nBachelor’s degree in computer science, information security, or equivalent experience.\n7+ years of experience in a SOC, incident response, or cybersecurity operations role.\nProven experience leading incident investigations and managing escalations.\nExperience working with a managed detection and response (MDR) provider (preferred).\nStrong understanding of security operations tools (SIEM, XDR, EDR, SOAR platforms).\nExperience with detection tuning, threat hunting, and log analysis.\nDemonstrated ability to develop SOC processes, playbooks, and operational documentation.\nStrong leadership, mentoring, and team development skills.\nExcellent analytical, problem-solving, and decision-making capabilities.\nStrong written and verbal communication skills.\nPreferred Qualifications\nExperience with Splunk, Microsoft Sentinel, Defender XDR, and/or similar platforms.\nExperience working in a hybrid SOC model (internal + MDR).\nFamiliarity with compliance frameworks (e.g., NIST, CMMC).\nRelevant certifications such as CISSP, GCIA, GCIH, or equivalent.\nThe Company is an Equal Opportunity Employer.","description_format":"text","description_chars":4784,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Wood Products & Furniture","Packaging & Labeling","Building Materials"],"lifecycle":[{"event":"open","at":"2026-10-14T22:02:26Z"}],"visa":[],"liveness":{"score":50,"band":"ok","label":"Likely open","p_open":0.9,"p_active":0.621,"p_room":0.9,"age_days":10,"expected_fill_days":18,"reasons":["conf:73","stale_co","velocity","win:mid","comp:brand"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/ufp-industries-lead-soc-analyst","json_url":"https://alion.io/job/ufp-industries-lead-soc-analyst.json","meta":{"generated_at":"2026-10-25T14:32:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20977,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2197721},"rest":"https://alion.io/mcp/rest/get_company?id=2197721"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fufp-industries-lead-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fufp-industries-lead-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fufp-industries-lead-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ufp-industries-lead-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fufp-industries-lead-soc-analyst"}]}