Security Operations Lead

Security Operations Lead

The Security Operations Lead is responsible for detection, triage, and response operations across our enterprise. This role blends hands-on incident handling with detection engineering, playbook development, and response automation efforts. This role delivers on alerts and case management, drives resilient detection strategies, and leads hunt efforts that proactively surface threats before they become incidents.

Joining a team of SOC Analysts, the Security Operations Lead sets the standard on how to identify, triage, and resolve cybersecurity incidents, and demonstrates this to the SOC team. This role is a great opportunity for a seasoned analyst to lead by example on how a global Security Operations Center should run.

Key Responsibilities

• Independently lead complex or high-impact security incidents and identify opportunities to improve SOC processes, tools, and response capabilities.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and establishing standards for documentation, communication, and delivery. Build and operationalize SOC playbooks and escalation workflows.
• Lead alert triage, enrichment, prioritization, and false-positive suppression.
• Author detection requirements and write and tune SIEM rules.
• Develop threat-hunting hypotheses and lead hunt efforts using advanced telemetry and threat intelligence.
• Design detection strategies across the kill chain and help advance the enterprise detection strategy.
• Execute complex incidents end-to-end, including containment, eradication, documentation, and communication.
• Conduct post-incident reviews and drive remediation and control improvements.
• Promote industry collaboration and embed resilient detection engineering practices.
• Advocate for and implement automation-first incident response.
• Provide technical guidance and mentorship to SOC Analysts, sharing best practices and setting standards for documentation, communication, and delivery.

Education and Experience

• Proven experience in a SOC or equivalent detection and response function, with a focus on high-fidelity detections, repeatable playbooks, and measurable outcomes.
• Three to five years of experience in Security Operations, Detection and Response, or Incident Handling; SOC experience is required.
• Hands-on experience with SIEM platforms, such as Google Security Operations, Microsoft Sentinel, or IBM QRadar; EDR platforms, such as CrowdStrike, Microsoft Defender, or SentinelOne; and SOAR platforms.
• Proficiency in authoring detections, tuning rules, developing enrichment pipelines, and improving alert routing.
• Demonstrated experience building and executing incident-response playbooks and containment and eradication plans.
• Experience conducting post-incident reviews and root-cause analyses and delivering corrective action plans to engineering teams.
• Scripting skills in Python, PowerShell, or Bash for automation, enrichment, and data analysis.
• Excellent written communication skills, including case documentation and executive-ready incident summaries
• Proficient in authoring detections, rule tuning, enrichment pipelines, and alert routing.
• Demonstrated capability in building and executing IR playbooks and containment/eradication plans.
• Experience conducting post-incident reviews and RCAs, and delivering corrective action plans to engineering teams.
• Scripting skills (Python/PowerShell/Bash) for automation, enrichment, and data wrangling.
• Excellent written communication for case documentation and executive-ready incident summaries.

Desired Skills and Abilities

• Demonstrates the ability to influence technical direction and cross-functional outcomes through expertise and sound judgment, without formal people-management responsibility.
• Transforms noisy telemetry into actionable signals.
• Is detail-oriented and disciplined in organizing information, developing repeatable playbooks, maintaining clear documentation, and closing feedback loops.
• Is prepared to mentor other analysts and set standards for SOC communication and delivery.
• Influences technical direction and cross-functional outcomes through expertise and sound judgment.
• Is comfortable presenting complex technical information to the CISO and other executive leaders.

Compensation

Competitive salary, commensurate with experience, and a generous benefits package that includes medical, dental, vision, life and disability insurance, paid vacation, and 401k plan.

Working Conditions

Location: Hybrid (This person can be based out of our Dallas/Frisco, TX or Conshohocken, PA Corporate Headquarters)

Note:

The essential responsibilities of this position are described under the headings above. They may be subject to change at any time due to reasonable accommodation or other reasons. Also, this document in no way states or implies that these are the only duties to be performed by the employee occupying this position.

Legends Global is an Equal Opportunity/Affirmative Action employer, and encourages Women, Minorities, Individuals with Disabilities, and protected Veterans to apply. VEVRAA Federal Contractor.