SOC and Incident Response Lead

We are looking for a SOC & Incident Response Lead to shape how our operational defense works. You’ll set the workflows, investigation standards and team rhythm, lead SOC analysts and IR & Forensics specialists, and turn security alerts into timely, evidence-based decisions and coordinated response that protect critical systems and data.

What you’ll do

• Build and mature the SOC and IR/DFIR function: define investigation standards, workflows and playbooks
• Lead and grow SOC analysts (L1/L2) and IR & Forensics specialists, owning prioritization, coaching and investigation quality
• Own alert queue prioritization, triage standards, escalation thresholds and handovers to keep SLA risks under control
• Set case creation, enrichment and evidence standards so confirmed incidents reach responders with full business and technical context
• Coordinate incident investigations: assign response roles and maintain timelines, evidence logs, decision records and action tracking
• Supervise forensic preservation and analysis of endpoint, server, cloud, network and identity telemetry with strict chain of custody
• Coordinate containment, eradication and recovery validation with IT, Platform, IAM, Product and business owners within the approved authority matrix
• Escalate production-impacting incidents, high-impact containment and regulatory or legal triggers through Cyber Defense leadership and approved decision paths
• Partner with Detection Engineering to turn recurring false positives and detection gaps into tuning while keeping coverage
• Run post-incident reviews and RCA, turning findings into tracked, measurable improvements
• Maintain operational metrics, sample case quality, update playbooks, run readiness exercises and recommend changes to escalation thresholds and staffing coverage

What you bring

• 3+ years in SOC and IR/DFIR, including mentoring, coaching or leading technical specialists
• A degree or training in InfoSec, Computer Science or IT, or equivalent hands-on SecOps/IR experience
• Hands-on SIEM and XDR/EDR skills, with the ability to correlate endpoint, identity, network and cloud events into a defensible timeline
• Strong alert queue management and SLA enforcement, prioritizing by asset criticality, identity and business impact
• Solid knowledge of forensic evidence collection, preservation, referencing and chain of custody
• A track record of building runbooks, case checklists and review frameworks that separate facts from assumptions
• Experience working with Detection Engineering to cut noise without compromising coverage
• A clear grasp of containment authority limits, escalation paths and regulatory or legal considerations in IR
• Calm, evidence-based judgment under pressure, clear communication with technical and business stakeholders, and strict care with confidential evidence
• English at Upper-Intermediate or higher

Nice to have

• Background in fintech, trading, financial services or other high-availability environments
• Scripting (Python, PowerShell, Bash), advanced queries, or safe automation for enrichment, triage and reporting
• Cloud investigations (AWS, Azure, GCP), threat hunting or detection engineering
• Certifications such as GIAC (GCIH, GCFA, GNFA), BTL1/BTL2, CISSP, CySA+ or vendor credentials

Work format
Full-time, remote, regular schedule, no shift work. On-call may be arranged; rotation and terms are agreed together.

What we offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company’s approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)