SOC Lead

AI in this role

We are seeking an experienced Lead SOC Analyst to oversee Security Operations Centre (SOC) activities, lead incident response efforts, and mentor a team of analysts. The successful candidate will have strong expertise in cyber threat detection, incident investigation, and the Splunk Enterprise Security (ES) platform.

Key Responsibilities

Lead day-to-day SOC operations and provide technical guidance to SOC Analysts.
Monitor, investigate, and respond to security incidents and alerts.
Develop, optimise, and maintain Splunk Enterprise Security use cases, correlation searches, dashboards, and reports.
Conduct threat hunting and advanced forensic investigations.
Coordinate incident response activities and provide detailed post-incident analysis.
Collaborate with IT, security, and business stakeholders to improve security posture.
Support SOC processes, playbooks, and continuous improvement initiatives.

Skills, Knowledge and Expertise

Extensive experience working in a SOC, Cyber Security, or Incident Response role.
Strong hands-on experience with Splunk Enterprise Security.
Experience leading security investigations and major incident response activities.
Knowledge of MITRE ATT&CK, SIEM technologies, threat intelligence, and security best practices.
Relevant certifications such as Splunk Certified Cybersecurity Defence Analyst, CISSP, GCIA, GCIH, or equivalent are desirable.

How we rate this

SOC Lead at NCC Group rates 36 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.