TQINE0088_6045 - SecOps Command Center Lead
Job Type: Contract,Permanent
Work Mode: Hybrid (3 Days from office)
Domain
SecOps Command Center (L1)
Scope
24x7 Security Monitoring, Alert Triage, Escalation & Shift Leadership
Lead and manage the L1 SecOps Command Center. Ensure consistent security monitoring, triage and escalation across shifts, while supervising the on-floor analyst team.
Process
Command Center Leadership
- Supervise the SecOps Command Center analysts across shifts, including rosters and shift handover.
- Own the shift schedule and make sure 24x7 security monitoring coverage has no gaps.
- Coach analysts on triage quality, tool use and SOP adherence.
- Review shift performance: alert volume, response times and missed alerts.
- Stakeholder Management, collaboration with different teams and attend the MIM meetings in case of P1/P2 incidents
- Be the point of escalation when an analyst cannot resolve or classify a security alert.
Monitoring and Triage
- Oversee continuous monitoring of security alerts across endpoint, network, DLP and identity tools. Analyze the alerts to reduce duplicate alerts/noise suppression and optimize the alerts.
- Confirm alerts are triaged, enriched and routed to the correct Application/MIM/Infra/L2 security tower within the target time if not resolved on the SOPs/Runbooks.
- Check service and endpoint availability monitoring, including agent health and coverage.
- Confirm ServiceNow tickets are raised, updated and closed with clear notes/logs.
- Escalate confirmed security incidents to the client's security team promptly, with evidence and recommended action.
Reporting and Improvement
- Produce and review the daily and weekly SecOps Command Center status report for leadership.
- Assist MIM to Run RCA and post-incident reviews for major or repeated security incidents.
- Keep SOPs, escalation matrices and knowledge-base articles current.
- Track and report on SLA and KPI performance for the Command Center.
Common
- Keep ServiceNow tickets and dashboards current, with clear resolution and closure notes.
- Work with DLP, Malware Tools, Network Security and IDAM leads on process and tooling changes.
Tools
- SIEM or security monitoring platform (Splunk)
- Endpoint (Jamf) and network security consoles (read access)
- Dashboarding and reporting tools
- Shift roster and workforce management tools
Technologies
- Windows Bit Locker for Laptop and basic knowledge of Network Security, IDAM, Malware & DLP
- Endpoint and service availability monitoring
- ITSM incident, problem and change processes
- Shift and workforce management
- SLA and KPI reporting
- RCA and continuous improvement
Experience
- 10+ Years of experience in a 24x7 Security Operations Center environment
- Experience leading or supervising a shift-based security monitoring team
- Knowledge of cybersecurity fundamentals.
- Security alert triage and escalation across endpoint, network and identity tools
- SLA/KPI reporting and RCA facilitation
- Clear written and spoken English, including leadership reporting
Peferred Certifications
- GIAC Security Essentials (GSEC) or equivalent SOC certification
#J-18808-Ljbffr
SecOps Command Center Lead employer: TESTQ TECHNOLOGIES LTD
TESTQ Technologies LTD. is an exceptional employer, offering a dynamic work culture that fosters innovation and collaboration in the heart of the UK Insurance and Financial Services sector. With a strong emphasis on employee growth, you will have the opportunity to mentor and lead talented data engineers while working on cutting-edge cloud technologies like AWS, Databricks, and MongoDB. The company prioritises a supportive environment that encourages professional development and provides unique advantages such as flexible working arrangements and a commitment to data governance and security.
