Cybersecurity Team Leader

Job Title: Cybersecurity Team Lead

The SOC Team Lead is a senior member of the cybersecurity team, responsible for overseeing day-to-day operations and guiding team members to ensure effective detection, response, and mitigation of cyber threats.

This role involves managing security incidents, optimizing SIEM systems, and contributing to the strategic direction of the cybersecurity program.

Key Responsibilities:

• Operational Oversight: Supervise daily cybersecurity operations, including monitoring, incident detection, and response activities, ensuring 24/7 coverage and timely resolution of security alerts.
• Incident Management: Lead the investigation, triage, and resolution of security incidents, coordinating with team members and external teams as needed.
• SIEM Optimization: Oversee the configuration, tuning, and maintenance of SIEM platforms to enhance threat detection and reduce false positives.
• Team Leadership: Mentor and guide team members, providing technical direction, training, and performance feedback to improve team capabilities.
• Threat Intelligence Utilization: Integrate and leverage threat intelligence feeds to enhance detection rules, correlation logic, and incident response strategies.
• Process Improvement: Develop, refine, and implement processes, playbooks, and standard operating procedures (SOPs) to ensure consistent and efficient operations.
• Reporting and Metrics: Generate and review reports on incident trends, SIEM performance, and cybersecurity metrics, presenting findings to stakeholders.
• Collaboration: Work closely with other IT and security teams to align cybersecurity activities with organizational goals.
• Automation and Scripting: Promote and support the use of automation tools and scripts to streamline repetitive tasks and improve response times.
• Escalation Point: Serve as the primary escalation point for complex incidents, providing expertise and decision-making during high-severity events.
• Training and Development: Facilitate training sessions and knowledge-sharing initiatives to upskill team members and promote certifications.

Required Skills and Qualifications:

• Education: Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field. A Master's degree or relevant certifications are preferred.
• Experience:
• 5-8 years of experience in cybersecurity, with at least 2-3 years in a cybersecurity environment and 1-2 years in a leadership or supervisory role.
• Hands-on Experience: Hands-on experience with SIEM platforms and incident response processes.
• Desirable Experience: Prior experience in a cybersecurity environment is highly desirable.
• Technical Skills:
• Strong knowledge of SIEM architecture, log management, and event correlation.
• Proficiency in network security tools and scripting skills in Python, PowerShell, or similar languages for automation and process optimization.
• Familiarity with cloud security platforms and their integration with cybersecurity tools.
• Understanding of network protocols, TCP/IP, and enterprise security technologies.
• Leadership and Analytical Abilities: Strong leadership and mentoring skills to guide and motivate team members. Excellent analytical and problem-solving abilities to address complex security incidents.
• Communication and Collaboration: Effective communication skills for reporting and collaborating with technical and non-technical stakeholders. Ability to perform under pressure and manage multiple priorities in a fast-paced environment.
• Certifications:
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• CompTIA Security+
• GIAC Security Operations Certified (GSOC)