Security Operations

• Lead & grow the team: Manage the SOC team, shape the roadmap, delegate effectively, and mentor engineers.
• Drive operations:
• – Define vulnerability management processes and coordinate stakeholders for timely remediation.
• – Design, implement, and operate SIEM/SOAR infrastructure (ingestion, normalization, correlation, alerting, playbooks).
• – Specify logging requirements across our main stacks and centralize telemetry in the SIEM.
• – Develop and tune correlation rules and detections; manage CTI intake and operationalize intel.
• – Run continuous improvement to reduce false positives and raise signal quality.
• – Establish crisp procedures for alert triage, escalation, and incident handling & investigation.
• – Lead incident communications with stakeholders and ensure thorough documentation.
• Engineering & enablement:
• – Contribute to security tooling, automation, and integrations that speed up detection/response.
• – Produce guidance and documentation for product/infra teams; contribute to compliance in the SOC perimeter.
• Exercises & assurance: Coordinate red/blue exercises, post-mortems, and targeted audits to validate coverage and resilience.

SOC Team Lead

Head of Global IT Infrastructure, Security Operations