Lead SOC Analyst

Lead SOC Analyst

Vaco is seeking a Lead SOC Analyst to join the team withone of our trusted local partners. This position requires both hands-on operational involvement and leadership responsibilities. The ideal candidate will oversee swing shift analysts, lead strategic initiatives to enhance team performance, identify operational gaps, improve processes and documentation, and effectively manage case prioritization across the team.

The Lead Analyst will directly supervise a team of junior and senior analysts during the swing shift and will report to the SOC Director. This is a full-time role offering a competitive base salary, quarterly discretionary bonuses, and comprehensive benefits. The standard shift runs from 1:00 PM to 9:00 PM or 12:00 PM to 8:00 PM (Phoenix Time).

Key Responsibilities:

• Develop and update SOC procedures, protocols, and systems

• Initiate and lead projects focused on technological and process improvements within SOC operations

• Oversee staffing and scheduling to ensure operational efficiency

• Act as the primary incident lead during major security events and handle customer escalations

• Design and deliver training programs covering all SOC functions

• Provide first-line supervision, mentorship, and leadership for swing shift team members

• Hire, train, and evaluate analysts; conduct performance reviews and provide professional development support

• Assist with alert triage and threat hunting as needed

• Be available on-call for escalated incidents and emergency SOC coverage

---

Requirements:

• Develop metrics and reporting systems to track team performance and success

• Strong skills in analyzing packet captures, data, and logs to support incident response and identify potential threats

• Deep understanding of TCP/IP, security architecture, and threat actor TTPs (tactics, techniques, and procedures)

• Experience working with SIEM platforms such as RSA NetWitness, Azure Sentinel, or Splunk

• Knowledge of incident response practices and associated reporting standards

• Excellent written and verbal communication skills

• Ability to perform well under pressure in a fast-paced environment

• Strong analytical thinking and problem-solving abilities

• Self-driven with the ability to manage multiple projects simultaneously

---

Preferred Qualifications:

• 4+ years of experience in triage and incident response within enterprise environments

• 4+ years analyzing logs and packet data for forensic investigations

• Experience mentoring or leading a technical team

• Advanced security certifications (e.g., CEH, GCIH, GCFA, GCFE, GCTI, GCIA, GREM, GPEN, GFNA, OSCP, CISSP, CISM)

• Familiarity with MITRE ATT&CK, web-based attacks, NIST or SANS Incident Handling procedures

• Strong knowledge of Windows and Linux OS, as well as core networking concepts

---

Shift Schedule:

• 1:00 PM 9:00 PM or 12:00 PM 8:00 PM (Phoenix Time)

---

Benefits:

• Health Insurance (80% employer-paid)

• Dental Insurance (80% employer-paid)

• Vision Insurance (80% employer-paid)

• Paid Sick Leave, Vacation, and Holidays

Determining compensation for this role (and others) at Vaco/Highspring depends upon a wide array of factors including but not limited to the individuals skill sets, experience and training, licensure and certifications, office location and other geographic considerations, as well as other business and organizational needs. With that said, as required by local law in geographies that require salary range disclosure, Vaco/Highspring notes the salary range for the role is noted in this job posting. The individual may also be eligible for discretionary bonuses, and can participate in medical, dental, and vision benefits as well as the companys 401(k) retirement plan.