About the Project
You’ll build and lead a SOC team from scratch for a global SaaS company (unicorn-stage, 20+ offices, Fortune 500 clients). The customer Security team is super strong and the stack is superior. As the first SOC leader (in charge of 6 Tier 2 analysts), you’ll upgrade existing response processes so the internal team can focus on security engineering.
You’re the escalation point for your analysts and the client’s IT, DevOps, and App Security teams, and you own 24/7 coverage, SOC KPIs, and the feedback loop to Security Engineering. This is not a ticket-closing role: you set the tone for how incidents are handled.
What You’ll Do
Lead the team: run the L2 analysts day-to-day (prioritization, playbooks, escalations), hold team syncs and handovers, and mentor and onboard analysts
Own 24/7 coverage: build and maintain shift schedules and on-call rotations so the SOC is always staffed
Own incident response: lead the full lifecycle from triage to closure, coordinate high-severity events and run post-incident reviews
Investigate hands-on: be the escalation point and work complex alerts alongside analysts, beyond Tier 2 capability
Measure and report: track team and individual performance and out comes against KPIs and SLAs (MTTA, MTTR, SLA compliance, false positive rate, backlog) and report to management and the client
Bridge to Security Engineering: turn analyst pain points (false positives, alert fatigue, detection gaps) into detection tuning and improvement suggestions.
Communicate clearly: work with the client’s security team at technical and managerial level, with honest status updates, including when something is unknown
What You Bring
Hard requirements (non-negotiable):
5+ years in SOC / incident response roles, including prior Tier 2/3 analyst experience. Not just monitoring: actual IR ownership
2+ years of team lead or management experience in a SOC, including shift lead or mentoring responsibility
Proven experience building and running 24/7 shift schedules and on-call rotations, and keeping coverage intact in practice
Proven experience owning SOC KPIs and SLAs (MTTA, MTTR, SLA compliance): you can show how you measured a team and improved it
Experience leading or coordinating a team during an active incident, and the ability to describe it step by step
Cloud / AWS security experience: ability to investigate and respond to cloud alerts on day one
SaaS investigation experience
SIEM hands-on: Splunk (required), with the ability to write and read SPL queries. CrowdStrike SIEM is a strong plus
EDR: Microsoft Defender and/or CrowdStrike
Working knowledge of both Windows and macOS environments
Strong communication skills, bridging SOC operations and Security Engineering. Intellectual honesty: you say “I don’t know” when you don’t know
Strong plus:
Identity platforms: Okta, Azure AD
SOAR automation and threat hunting
Experience building a SOC at level 4-5 based on SOC-CMM
Feeding analyst findings into detection engineering (tuning, new detections)
Things that won’t work here
Only closing alerts without owning the IR process
Never having owned a shift schedule, on-call rota or KPI reporting
Managing from the sidelines instead of investigating alongside the team
Confident wrong answers instead of acknowledged gaps
No ability to describe team coordination during a real incident
Tech Stack
Splunk · Microsoft Defender · CrowdStrike · Okta · AWS
What We Offer
Superior technical team and a great customer with massive modern infrastructure
AI everywhere, with the ability to automate every step: work smarter, not harder
Real ownership from day one to build the SOC processes, coverage model and KPIs
Direct collaboration with the client’s senior security team
Warsaw office (day shifts), with a flexible on-call and night coverage model you design with your team
Relocation support
