Security Operations Lead
Gruve
Full Time8+ yearsPosted 12 days ago
Let the right jobs find you
Get personalised suggestions from verified company career pages, matched to your role, location, level, and skills.
Overview
Position Type
Full Time
Experience
8+ years
Job Description
Position summary:
Senior L2 leading major-incident technical response until L3 engagement, owning the detection-content and tuning program day-to-day, and acting as deputy to the L3 Operations Lead.
Key responsibilities
- Lead technical response on major incidents (security and infrastructure) until L3 command engages.
- Own the detection-content backlog and tuning program execution with the L3 lead.
- Approve and execute high-risk changes; run problem management to eliminate recurring incidents.
- Own log-pipeline integration health: collectors, GCP Pub/Sub feeds, custom sources (Redfish listener, Aravolta webhooks, Hubble exporter) with escalation into engineering.
- Cross-train the L1 bench across towers; deputize for the L3 lead.
- Drive shift-quality audits and post-incident reviews.
Must-have
- 8–11 years with prior senior/lead experience in SOC or NOC and genuine cross-domain fluency.
- Incident command capability; deep SIEM content and query skills.
- Advanced network troubleshooting; automation mindset.
Good-to-have
- GCIH/GCIA, JNCIP, or CCIE written.
- MSSP/managed-services background; AI-SOC tooling exposure.