Lead (Security Operations)

FairPrice Group

Job description

Lead strategic initiatives to mature the SOC's capabilities, focusing on enhancing threat detection, accelerating response times, and improving overall operational efficiency.
Drive the adoption and optimization of a Security Orchestration, Automation, and Response (SOAR) platform, developing and refining playbooks to automate routine tasks and standardized response workflows.
Evaluate, recommend, and integrate new technologies and processes to keep our security posture ahead of the evolving threat landscape.

Oversee the health, performance, and policy governance of a diverse portfolio of enterprise-grade security technologies.
Ensure the effective day-to-day operation of core security platforms, such as Firewalls, XDR, DDoS Mitigation services, IPS, Email Filtering Gateways, and Privileged Access Management (PAM) solutions.
Act as the primary stakeholder for the security technology stack, ensuring tools are configured to best practices and aligned with the organization's risk appetite.

Lead the end-to-end incident response lifecycle, from initial triage and escalation by the MSSP to final resolution and reporting.
Serve as the incident commander during major security events, providing clear direction and communication to all stakeholders.
Oversee and, when necessary, directly participate in complex security investigations and digital forensics activities to determine the root cause, scope, and impact of incidents.
Drive the Incident Response Improvement and Planning process by developing, maintaining, and testing the corporate Incident Response Plan (IRP) through regular tabletop exercises and drills.

Develop and maintain key performance indicators (KPIs) and metrics to measure the effectiveness of the security operations function.
Create and present clear, concise reports and dashboards for technical teams and senior leadership to provide visibility into our security posture and incident trends.
Champion a culture of continuous improvement, using post-incident reviews and operational data to identify and implement enhancements to people, processes, and technology.
Ensure all processes, procedures, and security configurations are meticulously documented in runbooks and Standard Operating Procedures (SOPs).

Manage the strategic and technical relationship with our MSSP, ensuring alignment and driving maximum value from the partnership.
Monitor MSSP performance against Service Level Agreements (SLAs), review incident reports, and lead regular service review meetings to ensure quality and address challenges.

8-10+ years of experience in cybersecurity, with a significant portion in a Security Operations or Incident Response capacity.
Proven experience leading SOC modernization or transformation projects, with a strong understanding of how to mature a security operations function.
Hands-on experience with SOAR platforms and the development of automation playbooks.
Demonstrable experience in leading complex security investigations and a solid grasp of incident response methodologies.
Broad technical knowledge across multiple security domains, including network security, endpoint protection, and identity and access management.
Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Professional certifications such as CISSP, GCIH, GCFA, or GDAT.
In-depth knowledge of digital forensics and investigation techniques.
Familiarity with cybersecurity frameworks like the NIST Cybersecurity Framework and MITRE ATT&CK®.
Strong scripting and automation skills (e.g., Python, PowerShell) to support SOAR and custom integrations.
Experience presenting complex technical topics to non-technical audiences and senior leadership.