SOC Team Lead

SOC Team Lead

This position is ideally located in College Park, Maryland. Remote US candidates may be considered.

US Citizenship required for this role.

The schedule will be a Panama schedule: (slow rotating shift pattern that uses 4 teams and two 12-hour shifts to provide 24/7 coverage. The working and non-working days follow this pattern:  2 days on, 2 days off, 3 days on, 2 days off, 2 days on, 3 days off)

BlueVoyant is looking for Security Operations Center (SOC) Team Lead to help our global customers manage their IT security. You will be part of a fast-paced team that helps customers to reduce the impact of security incidents and ensures that critical business operations continue unhindered.

BlueVoyant SOC Team Leads are the first line leaders tasked with enabling efficient, world-class teams to defend clients from adversaries. As a technical expert and defensive strategist, you’ll be instrumental in guiding analysts through active intrusions, aiding clients in taking action, and building a culture of client-first detection and response.

Key Responsibilities
As a team lead the success of the team relies on your expertise to spot and respond to attacks before adversaries gain a foothold. Your visibility over incoming alerts allows you to spot trends, prioritize analysis work, and define the gold standard of analyst work.

As a Team Lead, you’ll directly supervise analysts on your shift, providing mentorship, workflow assistance, quality and performance reviews, and provide excellent customer service.

• Supervise and mentor Security Analysts during a standard working team/shift
• Manage analyst workload and workflows while acting as an escalation point for your team
• Communicate with BlueVoyant clients throughout incident escalations and lifecycle
• Supervise operations in deterring, identifying, monitoring, investigating, and analyzing attacks
• Support analyst alert triage to identify whether appropriate escalations occurred, and monitor for patterns indicating late-stage incident lifecycle alerts requiring incident response
• Provide quality control and feedback for analyst investigations
• Participate in the response, investigation, and resolution of security incidents
• Ensure teams are aware of operating procedures and any changes or additions
• Aid in keeping operational documentation up to date
• Provide incident investigation, handling, and response, including incident documentation
• Serve as the technical escalation point and mentor for your analyst team
• Perform triage of incoming issues (assess the priority, determine risk)
• Maintain a strong awareness of the current threat landscape

Basic Qualifications

1. People Skills:
   • Strong teamwork and interpersonal skills, including the ability to work effectively with a globally distributed team
   • Able and willing to work in a 24/7/365 environment, including nights and weekends, on a rotating shift schedule
   • Experience managing technical individual contributors, including providing feedback, monitoring quality, and prioritizing work
   • Strong customer communications skills, including articulating complex or urgent technical data and scenarios to non-technical audiences
   • Ability to handle high pressure situations in a productive and professional manner.
2. Tech Skills: 
   • Knowledge of and experience with intrusion detection/prevention systems and SIEM software
   • Advanced knowledge and understanding of network protocols and devices.
   • Advanced experience with Mac OS, Windows, and Unix systems.
   • Ability to analyze event logs and recognize signs of cyber intrusions/attacks
   • Advanced written and verbal communication skills and the ability to present complex technical topics in clear and easy-to-understand language
   • Familiarity with tools such as Malware Sandboxes, Sentinel, Splunk, EDR solutions
   • Strong knowledge of the following:
     • Enterprise Cloud Solutions (Azure, GCP, AWS)
     • Modern authentication systems and attacks (SSO, OATH, Entra, etc.) 
     • SIEM workflows (preferably Sentinel and Splunk)
     • Packet Analysis
     • Malware Detection, to include dynamic and light static analysis
     • Network Monitoring metadata (web logs, firewall logs, WAF/IDS)
     • Email Security and common business email compromise attacks
     • Vulnerability Identification and correlation to attacker behavior

Preferred Qualifications

• Experience in network/host vulnerability analysis, intrusion analysis, digital forensics, penetration testing, or related areas
•  5+ years of hands-on SOC/TOC/NOC experience
• GCIA and/or GCIH req