Security Operations Lead (SecOps)

Responsibilities

We are representing a confidential digital health organization that needs a Security Operations Lead to own their security operations function. In this role, you will:

• Serve as the hands-on technical lead for the Security Operations Center, setting technical direction for SIEM architecture, detection engineering, incident response, and the roadmap to scale defenses as the organization grows
• Own the SIEM end-to-end including architecture, data sources, normalization, retention, cost optimization, and tuning, evolving detection-as-code content aligned to MITRE ATT&CK and the organization's threat model
• Lead the SOC/CSIRT team technically by mentoring detection and response engineers, raising the bar on investigations, managing on-call and escalation models, and acting as incident commander during major incidents
• Drive AI- and automation-first transformation of security operations through SOAR playbooks, LLM-assisted triage workflows, and ML-driven detection to reduce MTTD/MTTR and expand coverage
• Lead high-severity incident response from detection through containment, eradication, recovery, and post-incident review, partnering with engineering, IT, legal, and executive stakeholders
• Run threat intelligence and threat hunting programs, converting emerging TTPs into new detections, proactive hardening, and informed risk decisions
• Define and report on SOC performance metrics including MTTD, MTTR, coverage, automation rate, and false-positive rate to drive continuous improvement
• Influence security architecture and engineering decisions across the company, ensuring detection, response, and recovery are built into new products and infrastructure
• Establish and continuously improve incident response playbooks, runbooks, and tabletop exercises to ensure organizational readiness

What We're Looking For

Required: Candidates must be able to obtain and maintain a US public trust clearance. US citizenship is required for this security clearance.

• Bachelor's degree in Computer Science, Cybersecurity, or equivalent professional experience
• 7+ years of experience in Security Operations
• Proven experience scaling a SOC through automation and AI including SOAR, hyperautomation, LLM-assisted triage, agentic workflows, or ML-driven detection with measurable impact on MTTR and coverage
• Hands-on experience structuring a SOC either from the ground up or through significant transformation including SIEM implementation, detection engineering practice, runbook libraries, and on-call rotations
• Deep SIEM expertise with platforms such as Splunk, Sentinel, Chronicle, or Elastic including ingestion architecture, detection-as-code, and query optimization
• Prior experience as the technical lead of a SOC or CSIRT team, owning the full incident response lifecycle and mentoring analysts and engineers
• Strong incident response track record leading high-severity investigations, root cause analysis, digital forensics, and post-incident reviews
• Solid experience in cloud environments, particularly AWS and/or GCP, with strong understanding of cloud-native threats and controls
• Strong scripting and development skills in Python, Go, Bash, or similar languages for building automation and internal tooling
• Working knowledge of EDR/XDR, identity, and network detection telemetry and how to combine signals into high-fidelity detections
• Fluency with security frameworks including NIST 800-61, CIS Controls, MITRE ATT&CK, and ISO 27001
• Background in threat modeling, adversary emulation, and risk-based alert tuning
• Excellent communication skills able to brief executives during critical incidents and translate technical risk into business language
• Proven track record leading cross-functional efforts in high-pressure situations
• Forensics experience investigating incidents and preserving digital evidence
• AI proficiency expected: candidates should demonstrate daily use of AI tools to boost productivity and ideally experience creating AI-driven workflows or tools

Note: Applicants must have a legal right to work in the United States. Immigration or work visa sponsorship will not be provided.

How We Work with You

Our talent team at Get A Job.ai partners with leading organizations to connect exceptional security professionals with confidential opportunities. Here's our process:

• Apply directly through the Get A Job.ai platform
• A recruiter from our team will screen your application and conduct an initial interview
• We will submit qualified candidates to our client for consideration
• Please do not attempt to contact the client directly, as all communications are managed through Get A Job.ai

Pay

Compensation details will be discussed with qualified candidates during the screening process. Our client offers comprehensive benefits including health, dental and vision insurance, life and AD&D insurance, equity shares, discretionary PTO, parental leave, 401(k), and flexible working hours in a remote-first environment.

Equal Employment Opportunity: Get A Job.ai is committed to creating a diverse and inclusive environment. We are an equal opportunity employer and do not discriminate on the basis of race, color, religion, sex, national origin, age, disability, veteran status, sexual orientation, gender identity, or any other legally protected characteristic.