SOC Lead - Tether

About the role

As the SOC Lead at Tether, you will be responsible for overseeing the security operations center, ensuring that security events are effectively monitored and responded to around the clock. You will lead a distributed team, coordinating shift schedules and managing incident responses to maintain a high level of security.

Your role will involve hands-on triage and investigation of security incidents, as well as the development of documentation and procedures to enhance the team's efficiency. Collaborating with various teams across the organization, you will work to improve the overall security posture and ensure that all incidents are managed effectively.

Skills that matter here

• Security Operations: This role requires substantial experience in security operations, including incident response and threat hunting.
• Incident Response: You will lead the response to major security incidents, coordinating efforts across multiple teams.
• EDR, SSE, SIEM, WAF: Hands-on knowledge of these security technologies is crucial for investigating and responding to threats.
• Leadership: Strong leadership skills are necessary to manage a distributed team and oversee SOC operations.

Who this role suits

• Candidates should have a solid background in cybersecurity, particularly in security operations and incident response.
• A proactive and detail-oriented approach to problem-solving will thrive in this role.
• Experience working with remote teams across different time zones is essential.
• Strong communication skills are important for interacting with both technical and non-technical stakeholders.

From the employer

• Lead, coach, and develop a distributed team of SOC Analysts working across multiple regions in a follow-the-sun model.
• Own the SOC schedule and shift rotations, including weekend coverage, ensuring continuous coverage across all time zones.
• Define and enforce the shift handover process, so that open investigations, ongoing incidents, and pending actions continue seamlessly around the clock.
• Act as the primary escalation point for the team and as incident lead for major security incidents, coordinating triage, analysis, containment, eradication, recovery, and post-incident reviews with relevant teams.
• Perform hands-on triage, investigation, and threat hunting alongside the team across the security stack, including SIEM, Endpoint Detection and Response (EDR), Security Service Edge (SSE), and Web Application Firewall (WAF) platforms.
• Review the quality of investigations and incident documentation, providing structured feedback and ensuring consistent standards across shifts and regions.
• Define, track, and report SOC metrics and KPIs, such as alert volumes, mean time to detect, mean time to respond, and false positive rates.
• Drive the improvement of detection content together with security engineering, prioritizing the tuning of SIEM correlation rules, EDR custom detections, and WAF rules, and mapping coverage to frameworks such as MITRE ATT&CK.
• Develop and maintain technical documentation, standard operating procedures, incident response playbooks, and escalation matrices.
• Contribute to the hiring, onboarding, and training of new SOC Analysts.
• Collaborate with IT, infrastructure, application, and security engineering teams, as well as management, to resolve incidents and support day-to-day operations.
• Support vulnerability management and drive continuous improvement of the organization's overall security posture.

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (or equivalent practical experience).
• At least 5 years of hands-on experience in Security Operations, including at least 1 year as a SOC Lead or in an equivalent team lead role.
• Proven experience triaging alerts, investigating security incidents, and leading the response to major incidents in a production environment.
• Solid working knowledge of core security technologies such as EDR, SSE, SIEM, and WAF, and of how to use them to investigate and respond to threats.
• Hands-on experience implementing, configuring, and tuning these platforms, or writing and tuning detection content, is a big plus.
• Experience leading or working in a 24/7 or follow-the-sun SOC, including managing shift schedules and remote teams across time zones.
• Strong experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework.
• Excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles.
• Relevant certifications such as Security+, CySA+, GCIA, GCIH, GSOM, CISSP, or vendor-specific credentials are a plus.
• Strong leadership, analytical, troubleshooting, and problem-solving skills with a high attention to detail.
• Ability to handle sensitive information responsibly and securely.
• Excellent written and verbal communication skills in English, including the ability to report to management and communicate clearly with technical and non-technical stakeholders during incidents.