SOC Technical Lead at uvcyber

<div> <p><strong>Position: SOC Technical Lead</strong><br><br>We are seeking a SOC Technical Lead who will serve as a technical mentor and strategic guide for the Security Operations Center. This role is focused on developing analyst capabilities, strengthening investigation quality, and driving consistent incident response practices. The ideal candidate will lead through guidance, coaching, and knowledge sharing, ensuring the SOC team operates with high efficiency and maturity.<br><br><strong>Key Responsibilities</strong></p> <p>Act as a technical leader and mentor, guiding SOC analysts in effective triage, investigation, and response</p> <p>Serve as the primary escalation point, providing direction on complex and high-severity incidents</p> <p>Drive continuous learning and development within the SOC through structured training and hands-on coaching</p> <p>Establish and promote best practices for incident investigation and response</p> <p>Ensure analysts follow a consistent and high-quality approach to security event analysis</p> <p>Conduct regular knowledge-sharing sessions, case reviews, and post-incident learning discussions</p> <p>Guide the team in understanding attacker behavior, detection logic, and investigation techniques</p> <p>Collaborate with Cyber Incident Response, Detection Engineering, and Threat Intelligence teams to enhance team knowledge and detection capabilities</p> <p>Support and guide development of KQL queries, use cases, and detection rules</p> <p>Provide direction on automation strategies using XSOAR and Sentinel</p> <p>Monitor SOC performance and guide improvements to meet SLA, MTTD, and MTTR targets</p> <p>Provide insights and recommendations to leadership on SOC maturity and improvements</p> <p><strong>Technical Skills Required</strong></p> <p>Microsoft Sentinel (SIEM)</p> <p>XSOAR (SOAR)</p> <p>Microsoft Defender Suite</p> <p>KQL (Kusto Query Language)</p> <p>MITRE ATT&amp;CK Framework</p> <p>Azure AD / Entra ID</p> <p>Windows/Linux logs and authentication</p> <p>Networking (TCP/IP, DNS, VPN)</p> <p>Incident response lifecycle and threat hunting</p> <p><strong>Preferred Qualifications</strong></p> <p>Certifications: SC-200 / AZ-500 / Security+ / CEH</p> <p>Experience in threat intelligence and IOC analysis</p> <p>Exposure to cloud security (Azure/AWS/GCP)</p> <p><strong>Soft Skills</strong></p> <p>Strong mentorship and coaching mindset</p> <p>Excellent analytical and problem-solving skills</p> <p>Ability to guide teams in high-pressure situations</p> <p>Clear and effective communication skills</p> <p>Focus on continuous improvement and team development</p> </div>