Security Operations Lead

SOC Leadership & 24/7 Monitoring

• Lead, mentor, and scale a global SOC team responsible for 24/7 monitoring, alert intake, triage, correlation, and escalation.
• Build operational rigor: processes, runbooks, SLAs, metrics, and quality standards for high-scale environments.
• Cover monitoring across:
• Cloud infrastructure (GCP, AWS, Azure)
• Kubernetes/GKE/EKS/AKS clusters
• SaaS platforms (Google Workspace, GitHub, Slack, Okta, etc.)
• Endpoints (macOS, Linux, Windows) including EDR/XDR telemetry
• Developer platforms + CI/CD pipelines
• AI/ML systems and model-serving workflows

AI-Based SOC Integration & Innovation

• Evaluate, adopt, and integrate AI-native SOC technologies for triaging, detection, and correlation
• Identify opportunities to automate triage, investigations, enrichment, and reporting.
• Serve as the internal expert on the capabilities and limitations of AI-based SOC tooling.

SIEM & Telemetry Ownership

• Own the entire SIEM ecosystem—ingestion, normalization, correlation, enrichment, tuning, dashboards, and metrics.
• Expand telemetry across:
• Cloud logs, API logs, system events
• SaaS audit logs and admin events
• Identity providers (Okta, Google, Azure AD)
• Endpoint EDR/XDR event streams
• Standardize data schemas and improve detection signal quality across sources.

Detection Engineering

• Develop high-fidelity detections for:
• Cloud-native attacks
• Identity threats and lateral movement
• SaaS misconfigurations and privilege abuse
• Endpoint malware/behavior anomalies
• Insider threats and account takeover patterns
• Use MITRE ATT&CK, MITRE Cloud Matrix, and threat intel to drive detection coverage.
• Collaborate with Engineering, Cloud Security, and SRE to ensure telemetry supports detection use cases.

Triage, Threat Analysis & Escalation

• Lead day-to-day triage and threat analysis activities, ensuring accurate categorization and prioritization.
• Drive complex investigations involving correlated events across cloud, SaaS, endpoints, and developer platforms.
• Guide root cause analysis and work with owners to drive remediation and architectural improvements.
• Continuously refine logic, reduce false positives, and improve signal quality.

Cross-Functional Collaboration

• Partner with Cloud Security on cloud posture and preventative controls.
• Work with Compliance/GRC to support SOC 2, ISO 27001, and audit readiness.
• Collaborate with SRE and Engineering to instrument new services with structured logs and detection hooks.
• Coordinate with IT / Endpoint teams to ensure full endpoint telemetry and EDR response readiness.
• Communicate threats, gaps, and trends to leadership and engineering stakeholders.