SOC Team Lead

Job description

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation. At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD. We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived. ***We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.*** The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24x7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift. This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes — not alert volume — and for meeting service-level commitments across a multi-tenant client base. The ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team. ### Summary of Essential Job Functions - Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model. - Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability. - Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification. - Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions. - Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership. - Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context. - Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development. - Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment. - Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement. - Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise. - Support client-facing communications during significant events, maintaining professionalism and clarity under pressure. - Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture. ### Experience and Certifications - 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience. - Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred. - One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications. - Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies. ### Technical Background Requirements - Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management. - Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework. - Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case. - Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise. - Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop. - Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment. ### Required Skills - Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment. - Excellent decision-making and judgment, especially under pressure and during active incidents. - Outstanding verbal and written communication, including client-facing communication during significant events.