Lead SOC Analyst

Job Title: Lead SOC Analyst
Location: Frisco, TX (Locals Preferred – Open to Remote)
Job Type: W2

Please go through the JD and send me resumes at  

Job Description:

We are seeking an experienced Security Operations Lead (SOC Lead Analyst) to strengthen and mature our Security Operations Center (SOC) capabilities. This role will lead incident response activities, enhance operational processes, and drive automation and efficiency across security operations.

The ideal candidate will have 5+ years of hands-on SOC experience, strong leadership in incident handling, and experience collaborating with managed service providers (MSPs). This role has a strong focus on operational excellence, continuous improvement, and security automation.

Key Responsibilities:

• Lead and coordinate security incident response activities

• Oversee incident triage, investigation, escalation, and resolution

• Develop, maintain, and improve SOC playbooks and runbooks

• Drive SOC metrics, KPIs, and reporting

• Improve SOC efficiency through automation workflows and SOAR

• Tune and optimize SIEM use cases, alerts, and detections

• Collaborate with managed security service providers (MSSPs)

• Perform root cause analysis and post-incident reviews

• Ensure continuous improvement of SOC processes and tools

• Document procedures, workflows, and best practices

Required Skills & Experience:

• 5+ years of experience in Security Operations / SOC

• Strong hands-on experience with incident response

• Experience working in a 24x7 SOC environment

• SIEM administration and tuning (Splunk, QRadar, Sentinel, Elastic, etc.)

• Experience with security automation / SOAR

• Strong understanding of threat detection and alert triage

• Experience developing playbooks and runbooks

• Knowledge of SOC metrics, KPIs, and SLAs

• Experience coordinating with MSPs / MSSPs

• Familiarity with MITRE ATT&CK framework

• Strong communication and documentation skills

Nice to Have:

• Threat hunting experience

• EDR/XDR tools (CrowdStrike, Defender, SentinelOne, etc.)

• Cloud security monitoring (AWS, Azure, Google Cloud Platform)

• Scripting (Python, PowerShell)

• Security certifications (GCIH, GCED, CISSP, etc.)