Security Operations Center Lead

Location: San Jose, California, United States

Salary: $149,100–$215,925 USD annually for the Bay Area, with incentive opportunities based on individual and company performance.

Company

hirify.global operates an enterprise environment requiring global security monitoring, incident response, cloud, identity, endpoint, network, and application protection.

What you will do

• Lead daily SOC operations, including monitoring, alert triage, investigations, escalation, incident response coordination, and operational handoffs across global time zones.
• Own SOC procedures, severity classification, escalation paths, response playbooks, major incident communications, post-incident reviews, and analyst quality assurance.
• Manage and improve monitoring across SIEM, SOAR, EDR/XDR, email security, cloud security, identity security, vulnerability signals, network telemetry, and threat intelligence.
• Build and tune detection use cases aligned with enterprise risks, MITRE ATT&CK techniques, threat intelligence, audit findings, and critical assets.
• Coordinate investigations involving endpoint compromise, identity misuse, phishing, malware, data loss indicators, cloud misconfigurations, suspicious network activity, and unauthorized access.
• Establish SOC metrics and reporting while driving automation, tabletop exercises, threat hunting, purple-team improvements, and incident-readiness initiatives.

Requirements

• Bachelor’s degree in computer science, computer engineering, information security, cybersecurity, or a related field, or equivalent practical experience.
• 5+ years of progressive cybersecurity experience, including hands-on security operations, incident response, threat detection, or SOC leadership.
• 3+ years of experience leading SOC analysts, incident response teams, managed security operations, or cross-functional cyber defense workflows.
• Strong knowledge of SIEM, SOAR, EDR/XDR, cloud security monitoring, identity security, email security, network security, and incident response.
• Experience improving detection use cases, alert triage workflows, response playbooks, escalation procedures, SOC metrics, and investigations.
• CISSP, Security+, or an equivalent industry certification; applicants must be eligible for any required U.S. export authorizations.

Nice to have

• Experience operating or transforming a global enterprise SOC or serving as an Incident Commander.
• Experience with Microsoft Sentinel, Microsoft Defender XDR, KQL, UEBA, or comparable security operations platforms.
• Experience with Azure, AWS, GCP, or hybrid cloud security monitoring.
• Background in threat hunting, purple-team collaboration, adversary emulation, detection engineering, or managed detection and response providers.
• Experience in semiconductor, technology, manufacturing, or intellectual property-intensive environments, plus familiarity with GenAI-assisted SOC workflows.

Culture & Benefits

• Global SOC coverage and cross-functional collaboration with security engineering, infrastructure, identity, cloud, IT operations, legal, privacy, product security, and managed service providers.
• Regular focus on measurable improvements in detection coverage, alert quality, response speed, automation, and operational resilience.
• Incentive opportunities based on individual and company performance.
• Security processes are expected to remain documented, repeatable, measurable, and audit-ready.