Security Operations Lead

Replit

Security Operations Lead managing global SOC functions for 24/7 detection and response capabilities. Overseeing monitoring across multi-cloud environments, collaborating with cross-functional teams.

Posted 7/10/2026full-timeFoster City • California • 🇺🇸 United StatesSenior💰 $220,000 - $325,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading and scaling Security Operations Center (SOC) teams, with a strong focus on cloud security monitoring, SIEM platforms, and detection engineering. Proficient in developing operational processes and metrics while integrating AI-native technologies for enhanced threat detection and triage.

Highest-signal resume keywords

Security Operations LeadershipSIEM Platform ExpertiseCloud Security MonitoringDetection Engineering SkillsAI-Based SOC Technologies

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security OperationsSIEM PlatformsCloud Security MonitoringEDR/XDR ToolsDetection EngineeringEvent CorrelationThreat HuntingLog AnalysisScripting (Python, Go, Bash)Identity Security

Soft Skills

MentoringCollaborationProblem-SolvingCommunication

Tools & Technologies

GCPAWSAzureKubernetesCrowdStrikeSentinelOneDefenderGoogle WorkspaceGitHubSlack

Certifications & Qualifications

SOC 2ISO 27001

Industry Keywords

Cloud InfrastructureSaaS PlatformsEndpoint SecurityMITRE ATT&CKBehavioral DetectionsComplianceAudit ReadinessCloud Kill ChainsPrivileged AbuseInsider Threats

Tech Stack

Tools & technologies

AWSAzureCloudGoGoogle Cloud PlatformKubernetesLinuxMacOSPythonSplunk

About the role

Key responsibilities & impact

Lead, mentor, and scale a global SOC team responsible for 24/7 monitoring, alert intake, triage, correlation, and escalation.
Build operational rigor: processes, runbooks, SLAs, metrics, and quality standards for high-scale environments.
Cover monitoring across:
- Cloud infrastructure (GCP, AWS, Azure)
- Kubernetes/GKE/EKS/AKS clusters
- SaaS platforms (Google Workspace, GitHub, Slack, Okta, etc.)
- Endpoints (macOS, Linux, Windows) including EDR/XDR telemetry
- Developer platforms + CI/CD pipelines
- AI/ML systems and model-serving workflows.
Evaluate, adopt, and integrate AI-native SOC technologies for triaging, detection, and correlation.
Identify opportunities to automate triage, investigations, enrichment, and reporting.
Own the entire SIEM ecosystem—ingestion, normalization, correlation, enrichment, tuning, dashboards, and metrics.
Develop high-fidelity detections for:
- Cloud-native attacks
- Identity threats and lateral movement
- SaaS misconfigurations and privilege abuse
- Endpoint malware/behavior anomalies
- Insider threats and account takeover patterns.
Lead day-to-day triage and threat analysis activities, ensuring accurate categorization and prioritization.
Partner with Cloud Security on cloud posture and preventative controls.
Work with Compliance/GRC to support SOC 2, ISO 27001, and audit readiness.

Requirements

What you’ll need

7+ years of experience in Security Operations, with 3+ years in a senior or lead capacity.
Experience leading or collaborating with 24/7 SOC environments (internal, hybrid, or MSSP).
Strong experience with SIEM platforms (Chronicle, Splunk, Elastic, Sentinel, Panther, etc.).
Deep understanding of:
- Cloud security monitoring (GCP required; AWS/Azure preferred)
- SaaS security monitoring (Okta, Google Workspace, GitHub, Slack, etc.)
- Endpoint security telemetry (EDR/XDR tools such as CrowdStrike, SentinelOne, or Defender)
- Kubernetes and container detection
Hands-on detection engineering skills, event correlation, threat hunting, and log analysis.
Familiarity with AI-based SOC platforms and LLM-driven detection/triage tools.
Strong understanding of identity security, OAuth/OIDC, and API telemetry patterns.
Experience with SOAR and scripting (Python, Go, Bash).
Knowledge of MITRE ATT&CK, cloud kill chains, behavioral detections, and detection lifecycle management.

Benefits

Comp & perks

Competitive Salary & Equity
401(k) Program with a 4% match (*US Only*)
Health, Dental, Vision and Life Insurance
Short Term and Long Term Disability
Paid Parental, Medical, Caregiver Leave
Flexible Time Off (FTO) + Holidays
Commuter Benefits (*In-Office Only*)
Monthly Wellness Stipend
Autonomous Work Environment
In Office Set-Up Reimbursement (*In-Office Only*)
Quarterly Team Gatherings
In Office Amenities (*In-Office Only*)