SOC Lead – Global Cybersecurity Operations

About the role

We are seeking a highly technical SOC Lead to own and evolve our global 24/7 security operations ecosystem. The role combines deep‑dive cloud investigations, AI‑driven automation, and mentorship of a high‑performing engineering team.

Key responsibilities

• Design, build and optimise operational frameworks for 24/7 monitoring and serve as the critical escalation point for high‑impact incidents.
• Lead comprehensive investigations across endpoint, network, email and identity vectors, focusing on multi‑cloud environments (AWS, Azure, GCP) using CNAPP, EDR/XDR and digital forensics tools.
• Architect and drive the roadmap for an autonomous, AI‑enabled SOC, overseeing AI agents and complex SOAR playbooks.
• Lead SOC projects to optimise EDR platforms, enhance Email Security Gateways and launch proactive threat‑hunting campaigns.
• Act as technical Incident Commander during critical events, coordinating the full incident‑response lifecycle.
• Mentor SOC analysts, establish continuous learning frameworks and conduct technical tabletop exercises.

Required profile

• 8+ years of hands‑on information security experience, including at least 3 years in a senior or lead SOC/Incident Response role.
• Proven experience building and managing 24/7 monitoring structures and on‑call rotations.
• Deep technical mastery of modern security architectures such as EDR/XDR, Email Security Gateways and digital forensics.
• Strong expertise in cloud security forensics across AWS, Azure and GCP, with experience using CNAPP platforms.
• Demonstrated ability to lead technical projects and mentor engineering teams.

Required skills

• EDR/XDR platforms
• Email Security Gateways
• Digital forensics tools
• CNAPP solutions
• AWS, Azure, GCP
• Python scripting
• Bash scripting
• SOAR orchestration
• AI‑driven automation concepts