SOC Team Lead – Managed Security Services

Company Description
SOCRoom by Procain consulting, helps businesses strengthen security operations with continuous monitoring, faster response, and expert SOC support.
We work with organisations that need better visibility, alert handling, incident response, and security operations coverage without building a full SOC in-house.
Our services include Managed SOC, SOC as a Service, SOC Staff Augmentation, Cloud Security Monitoring, threat detection, alert triage, and incident response support.
Built on the principle of Detect. Prevent. Prevail., SOCRoom by Procain consulting, helps teams move from security alerts to real action - faster, sharper, and with greater operational confidence.
Key responsibilities
Team leadership and shift operations
Lead, mentor and schedule a team of L1/L2 analysts to maintain 24x7 coverage and consistent
service quality.
Own shift handovers, ensuring every open incident transfers with current status, next action and
owner.
Conduct quality reviews of closed incidents, verifying verdicts (true positive, benign positive,
false positive) and documentation.
Coach analysts on investigation methodology, KQL and tooling; drive onboarding and structured
skills development.
Incident detection and response
Act as the escalation point for high-severity incidents, including lateral movement, privileged
account compromise and data exfiltration.
Direct investigations from initial alert through entity analysis, timeline reconstruction,
containment and closure.
Coordinate containment actions with customer IT and security teams, and with L3 / incident
response specialists where needed.
Lead post-incident reviews and translate lessons learned into detection and process
improvements.
Microsoft Sentinel platform ownership
Oversee analytics rule lifecycle: design, testing, tuning, alert grouping, suppression and
retirement of noisy rules.
Develop and review KQL queries, hunting queries, workbooks and watchlists.
Guide automation using playbooks (Logic Apps) and automation rules to reduce manual triage
effort.
Work with engineering teams on data connector onboarding, log source health and ingestion
cost optimization.
Wazuh operations (where deployed)
Supervise monitoring of Wazuh-managed customer environments, including agent health, rule
and decoder tuning, and alert triage.
Support integration of Wazuh alerts into central SOC workflows and ticketing.
Customer engagement and reporting
Serve as a technical point of contact for customers during incidents and in regular service
reviews.
Produce monthly SOC reports covering incident trends, SLA performance, detection coverage
and recommendations.
Ensure adherence to contractual SLAs for time-to-triage, time-to-escalate and time-to-notify.
Maintain and improve runbooks, escalation matrices and standard operating procedures.
Required qualifications (mandatory)
Bachelor's degree in Computer Science, Information Security or a related field, or equivalent professional experience.
5+ years of experience in a SOC, MSSP or MDR environment, including at least 1–2 years leading or mentoring analysts.
Hands-on experience with Microsoft Sentinel (minimum 2 years in production), covering analytics rules, incidents, entity investigation, workbooks, watchlists, UEBA and playbooks.
Strong proficiency in KQL for detection engineering, threat hunting and investigation.
Working knowledge of the Microsoft security ecosystem: Defender XDR (Endpoint, Identity, Office 365, Cloud Apps), Entra ID and Azure activity logs.
Solid understanding of the incident response lifecycle, the MITRE ATT&CK framework and common attack techniques.
Good knowledge of networking, Windows and Linux internals, Active Directory and cloud security fundamentals.
Experience working to customer SLAs in a multi-tenant or managed services environment.
Excellent written and verbal communication skills, including incident reporting to technical and executive audiences.
Willingness to work in a 24x7 rotational environment and to be available for on-call escalations.
Preferred qualifications
Hands-on experience with Wazuh: agent deployment, custom rules and decoders, active response, file integrity monitoring and vulnerability detection.
Microsoft certifications such as SC-200 (Security Operations Analyst), AZ-500 or SC-100.
Industry certifications such as GCIH, GCIA, CySA+, BTL1/BTL2, or equivalent incident response credentials.
Experience with other SIEM/SOAR platforms (Splunk, QRadar, Elastic) and EDR tools (CrowdStrike, SentinelOne).
Scripting skills in PowerShell or Python for automation and enrichment.
Exposure to threat intelligence platforms, threat hunting programs and detection-as-code practices.
Familiarity with compliance frameworks such as ISO 27001, SOC 2, PCI DSS or NIST CSF.
Key competencies
Leadership: builds a motivated, accountable team and develops analysts into senior contributors.
Analytical judgment: makes sound, timely decisions under pressure with incomplete information.
Customer focus: communicates clearly and calmly with customers during active incidents.
Continuous improvement: uses data to reduce false positives, improve detection coverage and streamline workflows.

Work arrangement
No