Team Lead, SOC

We are seeking a highly skilled and motivated Security Analyst Team Lead to guide and support our security operations team. The successful candidate will provide leadership, management, technical expertise, and mentorship to a team of security analysts, ensuring effective investigation of alerts, escalation to our customer and continuous improvement of security operations.

They must demonstrate the ability to confidently manage and mentor junior analysts at both R1 and R2 levels, providing guidance, oversight, and support in day-to-day operations. Strong leadership skills should be complemented by excellent communication and stakeholder management capabilities.

 As the role and wider team are fully remote, the ability to communicate clearly, consistently, and effectively—both verbally and in writing—is essential for successful collaboration and leadership in a distributed environment. They should be highly capable of producing clear, thorough, and high-quality documentation, including incident reports, standard operating procedures, and technical playbooks. Familiarity with security frameworks such as MITRE ATT&CK, NIST, or ISO 27001 is expected.

We are really looking for someone who is a self-starter, someone who can fully embrace and own their work. Taking the initiative and pulling people together towards the main goal. 
 
 This role involves working on a rotating shift pattern that includes both day and night shifts as well as occasional on call duty. As part of their responsibilities, the candidate will be expected to directly investigate security tickets, ensuring timely and thorough analysis, appropriate escalation, and effective resolution. A hands-on approach to incident handling is essential, as is the ability to work independently during out-of-hours shifts.
 
 The candidate will be responsible for validating filtering and tuning opportunities within the detection environment to reduce false positives and enhance alert fidelity. Due to this, the role requires strong analytical skills, technical proficiency, and a commitment to continuous learning in a dynamic security environment using Splunk as its SIEM of choice.