{"id":3453941,"url":"https://alion.io/job/underdefense-soc-team-lead","title":"SOC Team Lead","company":{"id":2017495,"name":"UnderDefense","domain":"underdefense.com","url":"https://alion.io/company/underdefense","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ukraine"],"countries":["UA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":28000,"max_usd":72000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":753},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Okta","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-26T18:24:58Z","employer_posted_date":null,"last_verified_at":"2026-10-26T18:24:58Z","board_verified":false,"closed_at":null,"days_open":8,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":8},"description":"About the Project\n\nYou’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+ offices, Fortune 500 clients). The customer Security team is super strong and the stack is superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing response processes so the internal team can focus on security engineering.\n\nYou’re the escalation point for your analysts and the client’s IT, DevOps, and App Security teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering. This is not a ticket-closing role: you set the tone for how incidents are handled.\n\nWhat You’ll Do\n\nLead the team: run the L2 analysts day-to-day (prioritization, playbooks, escalations), hold team syncs and handovers, and mentor and onboard analysts\n\nOwn 24/7 coverage: build and maintain shift schedules and on-call rotations so the SOC is always staffed\n\nOwn incident response: lead the full lifecycle from triage to closure, coordinate high-severity events and run post-incident reviews\n\nInvestigate hands-on: be the escalation point and work complex alerts alongside analysts, beyond Tier 2 capability\n\nMeasure and report: track team and individual performance and out comes against KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and report to management and the client\n\nBridge to Security Engineering: turn analyst pain points (false positives, alert fatigue, detection gaps) into detection tuning and improvement suggestions.\n\nCommunicate clearly: work with the client’s security team at technical and managerial level, with honest status updates, including when something is unknown\n\nWhat You Bring\n\nHard requirements (non-negotiable):\n\n5+ years in SOC / incident response roles, including prior Tier 2/3 analyst experience. Not just monitoring: actual IR ownership\n\n2+ years of team lead or management experience in a SOC, including shift lead or mentoring responsibility\n\nProven experience building and running 24/7 shift schedules and on-call rotations, and keeping coverage intact in practice\n\nProven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance): you can show how you measured a team and improved it\n\nExperience leading or coordinating a team during an active incident, and the ability to describe it step by step\n\nCloud / AWS security experience: ability to investigate and respond to cloud alerts on day one\n\nSaaS investigation experience\n\nSIEM hands-on: Splunk (required), with the ability to write and read SPL queries. CrowdStrike SIEM is a strong plus\n\nEDR: Microsoft Defender and/or CrowdStrike\n\nWorking knowledge of both Windows and macOS environments\n\nStrong communication skills, bridging SOC operations and Security Engineering. Intellectual honesty: you say “I don’t know” when you don’t know\n\nStrong plus:\n\nIdentity platforms: Okta, Azure AD\n\nSOAR automation and threat hunting\n\nExperience building a SOC at level 4-5 based on SOC-CMM\n\nFeeding analyst findings into detection engineering (tuning, new detections)\n\nThings that won’t work here\n\nOnly closing alerts without owning the IR process\n\nNever having owned a shift schedule, on-call rota or KPI reporting\n\nManaging from the sidelines instead of investigating alongside the team\n\nConfident wrong answers instead of acknowledged gaps\n\nNo ability to describe team coordination during a real incident\n\nTech Stack\n\nSplunk · Microsoft Defender · CrowdStrike · Okta · AWS\n\nWhat We Offer\n\nSuperior technical team and a great customer with massive modern infrastructure\n\nAI everywhere, with the ability to automate every step: work smarter, not harder\n\nReal ownership from day one to build the SOC processes, coverage model and KPIs\n\nDirect collaboration with the client’s senior security team\n\nWarsaw office (day shifts), with a flexible on-call and night coverage model you design with your team\n\nRelocation support","description_format":"text","description_chars":3888,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Artificial Intelligence","Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-29T12:21:41Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":8,"expected_fill_days":31,"reasons":["seen:8","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/underdefense-soc-team-lead","json_url":"https://alion.io/job/underdefense-soc-team-lead.json","meta":{"generated_at":"2026-11-04T16:07:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24676,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2017495},"rest":"https://alion.io/mcp/rest/get_company?id=2017495"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Funderdefense-soc-team-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Funderdefense-soc-team-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Funderdefense-soc-team-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/underdefense-soc-team-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Funderdefense-soc-team-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3453941}},{"tool":"search_jobs","arguments":{"company":"underdefense.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3453941},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}