SOC Team Lead

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual’s race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

The SOC Team Lead is the operational owner of the Security Operations Center during their shift and a key leadership layer in AHEAD’s modern, AI-enabled Managed Security Services. In a 24×7 follow-the-sun model, the Team Lead provides real-time accountability for service quality, ensures every client environment is covered, and serves as the primary quality and escalation checkpoint for the analysts on shift.

This role blends hands-on security expertise with people leadership. The Team Lead manages the queue and analyst workload, oversees agentic triage and human-in-the-loop validation, coaches Tier 1 and Tier 2 analysts, and coordinates response during active incidents. They are accountable for high-fidelity, defensible outcomes — not alert volume — and for meeting service-level commitments across a multi-tenant client base.

The ideal candidate is an experienced analyst ready to lead: someone who can make sound decisions quickly, maintain calm and clear communication during incidents, uphold quality standards, and develop the people around them. They set the tone for a resilient, quality-focused, continuously improving team.

Summary of Essential Job Functions

• Own SOC operations during the assigned shift, ensuring continuous 24×7 monitoring coverage and clean, accountable handoffs across the follow-the-sun model.

• Manage the alert and case queue, balancing analyst workload, prioritizing high-severity events, and ensuring cases move with urgency and accountability.

• Serve as the primary quality-assurance checkpoint for the shift — reviewing cases for accuracy, completeness, and defensibility before escalation or client notification.

• Act as the first point of escalation for analysts, providing technical guidance on complex investigations and making or supporting incident-declaration decisions.

• Coordinate incident response activities during active incidents, including communication, task assignment, and status updates to clients and SOC leadership.

• Oversee the human-in-the-loop layer on top of agentic triage and suppression — ensuring AI-driven outcomes are validated, tuned, and enriched with appropriate client context.

• Coach, mentor, and develop Tier 1 and Tier 2 analysts, providing real-time feedback and supporting structured ramp and skills development.

• Monitor and drive shift performance against key service metrics, including MTTD, MTTR, MTTC, false-positive rate, and SLA attainment.

• Ensure consistent adherence to SOPs, runbooks, playbooks, and quality standards, and contribute to their continuous improvement.

• Partner with detection engineering and Tier 2 to surface tuning and suppression opportunities and reduce recurring noise.

• Support client-facing communications during significant events, maintaining professionalism and clarity under pressure.

• Escalate people, process, and platform issues to the SOC Manager, and contribute to a resilient, quality-focused, continuous-improvement culture.

Experience and Certifications

• 5–8 years of experience in security operations or incident response, including demonstrated Tier 2 / senior analyst experience.

• Prior experience as a shift lead, team lead, or in a mentorship / quality-review capacity is strongly preferred.

• One or more of the following certifications is preferred: GIAC (GCIH, GCIA, GCFA), CompTIA CySA+, CISSP, CISM, Microsoft SC-200, or Palo Alto Networks (XSIAM / Cortex) certifications.

• Hands-on experience across SIEM, EDR / XDR, SOAR, and related security technologies.

Technical Background Requirements

• Deep, hands-on knowledge of SOC operations, detection and response workflows, and incident management.

• Advanced understanding of operating systems, networking, attacker tactics, and the MITRE ATT&CK framework.

• Strong experience with SIEM platforms (Elastic Security, Palo Alto Cortex XSIAM), EDR / XDR, and SOAR, including case management and correlation from event to alarm to SOAR case.

• Working knowledge of detection tuning, alert suppression, and detection-as-code concepts, and how they improve fidelity and reduce noise.

• Familiarity with AI-assisted and agentic security operations and the governance / guardrails required to keep autonomy safe, auditable, and human-in-the-loop.

• Understanding of service-level objectives and operational security metrics in a multi-tenant MSSP / MDR / MXDR environment.

Required Skills

• Strong leadership presence with the ability to direct, coach, and motivate analysts in a fast-paced 24×7 environment.

• Excellent decision-making and judgment, especially under pressure and during active incidents.

• Outstanding verbal and written communication, including client-facing communication during significant events.

• Ability to uphold and enforce quality standards while developing people and maintaining team morale.

• Strong prioritization and organizational skills to manage queue, coverage, and workload simultaneously.

• Availability to work a shift-based schedule, including nights, weekends, or holidays and on-call rotation as required.

• A continuous-improvement mindset and enthusiasm for leading a team through an AI-enabled transformation.

Education

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security, or a related field — or equivalent professional experience and certifications.

The compensation range indicated in this posting reflects the On-Target Earnings (“OTE”) for this role, which includes a base salary and any applicable target bonus amount. This OTE range may vary based on the candidate’s relevant experience, qualifications, and geographic location.

Why AHEAD

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

USA Employment Benefits include

– Medical, Dental, and Vision Insurance

– 401(k)

– Paid company holidays

– Paid time off

– Paid parental and caregiver leave

– Plus more! See benefits https://www.aheadbenefits.com/ for additional details.

Use of AI

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, assessing responses, or to capture recordings and create transcriptions or summaries during interviews. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please refer to the Candidate Privacy Notice or contact us at privacy@ahead.com.

You may opt-out of the review or analysis of your application and resume by AI tools by using the General Application. Please include the role you wish to apply for in the Additional Information field. You may also choose to opt-out of recording and transcription at any time, including after joining an interview. Candidates will not be penalized for choosing to opt-out.