SOC Team Lead

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

Summary of Essential Job Functions
-

Own SOC operations during the assigned shift, ensuring continuous 24x7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.

-

Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.

-

Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.

-

Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions.

-

Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.

-

Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated , tuned, and enriched with appropriate client context.

-

Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.

-

Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.

-

Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.

-

Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.

-

Support client-facing communications during significant events , maintaining professionalism and clarity under pressure.

-

Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous- improvement culture.

Experience and Certifications
-

5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.

-

Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.

-

One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA +, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.

-

Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.

Technical Background Requirements
-

Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.

-

Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.

-

Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.

-

Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.

-

Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop.

-

Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.

Required Skills
-

Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24x7 environment.

-

Excellent decision-making and judgment, especially under pressure and during active incidents.

-

Outstanding verbal and written communication, including client-facing communication during significant events .

-

Ability to uphold and enforce quality standards while developing people and maintaining team morale.

-

Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.

-

Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation as required .

-

A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.

Education
-

Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.