SOC Lead - CrowdStrike SME (Falcon | NG SIEM)

Overview

Role Overview

SOC Lead

SOC Operations & Incident Management

• Act as the L2 & L3 escalation point for security alerts, incidents, and investigations.
• Lead end-to-end incident response (triage, containment, eradication, recovery, and RCA).
• Perform deep-dive analysis of complex alerts across XDR, SIEM, and MDR platforms.
• Leverage platforms such as CrowdStrike Falcon, NG SIEM (LogScale), Taegis, Microsoft Defender XDR, Rapid7, QRadar, Splunk, or similar tools.

SOC Process & Documentation Development

• Develop and enhance SOC SOPs, runbooks, playbooks, and escalation workflows.
• Standardise detection and response processes across different environments and log sources.
• Maintain and expand the SOC knowledge base and operational documentation.
• Ensure compliance with MSSP SLAs, KPIs, and reporting standards.

Threat Hunting & Detection Engineering

• Conduct proactive threat hunting activities using XDR, SIEM, and threat intelligence.
• Develop and optimise detection rules, correlation logic, and analytics use cases.
• Tune alerts to reduce false positives and improve detection accuracy.

Required Qualifications

• **7+ years of cybersecurity experience**
• , with at least
• 6+ years in SOC operations within an MSSP environment
• .
• Strong hands-on experience with
• CrowdStrike Falcon / NG SIEM OR Taegis platform (mandatory)
• .

Ccse, Ccfa, Ccfr, Ccfh

• )
• Taegis / Secureworks / Sophos certifications
• GIAC (GCIH, GCIA) or CISM