SOC Lead

About the role

Inchcape Digital, part of Inchcape's global network, is looking for a SOC Lead to join its Security platform. The role is a hands-on cybersecurity leadership position combining technical expertise, incident response and people management, leading analysts through complex investigations, building team capability and delivering a world-class security operations service.

Key responsibilities

• Lead SOC shifts and give day-to-day operational direction to L1 and L2 analysts, keeping alerts, incidents, investigations, handovers and escalations aligned with SOC procedures.
• Act as the main technical escalation point for complex alerts and incidents, using advanced investigation skills across SIEM, EDR, email security, identity, cloud, endpoint and security monitoring.
• Use knowledge of operating systems, networking, Active Directory, cloud services and enterprise environments to support investigations and resolve incidents.
• Review and quality-assure analyst investigations, case notes, evidence, timelines and incident records, escalating incidents appropriately.
• Manage incident and operational escalations by risk, threat severity and business impact, updating the Head of SOC and stakeholders.
• Support analysts on the on-call rota with technical leadership and guidance.
• Coach and mentor analysts through regular one-to-ones, feedback and career support.
• Work with the Head of SOC to improve processes, playbooks, runbooks, detections, reporting and knowledge management.

Required profile

• Strong SOC operations experience, including hands-on investigation of complex alerts and incidents as a Level 2 or Level 3 analyst.
• Ability to lead shifts, prioritise work, manage escalations and make sound decisions under pressure.
• Strong understanding of common attack techniques, incident response, threat intelligence, malware analysis, phishing investigations and account compromise workflows.
• Ability to set quarterly goals with the Head of SOC and commit to continuous improvement and operational discipline.

Required skills

• SIEM, EDR, SOAR, email security, identity, cloud, endpoint and ticketing platforms
• Windows and Linux, Active Directory, networking, authentication and cloud technologies