STAFFY For people. For companies.
Back to jobs

New opportunity

Security Operations Lead – SOC, Detection Engineering & Incident Response

Remoto Remoto Senior

About the company

We are a young and fast-growing recruiting company with five years of experience working across Latin America and the United States. We partner closely with teams and founders to help them build strong, high-impact teams through recruitment, outsourcing, and team-building services.

Our culture is built on effective communication, trust, and transparency. We believe great work happens when people feel heard, supported, and empowered to grow. Today, our team is made up of more than 80 professionals working across different projects throughout the region, collaborating remotely and learning from each other every day.

About the role

We are looking for a Security Operations Lead to own and drive the operational effectiveness of a Security Operations function, overseeing SOC operations, detection engineering, threat intelligence, and security incident response.

This is a hands-on leadership role that combines technical security expertise, operational management, and team development. You will be responsible for ensuring effective 24/7 security monitoring, improving detection capabilities, leading incident response activities, and continuously optimizing security operations processes and tooling.

You will work extensively with Microsoft Sentinel, Microsoft Defender, KQL, SIEM, EDR, NDR, and SOAR technologies, while collaborating with technical teams and stakeholders to strengthen detection coverage and incident response capabilities.

Beyond managing the team, you will actively participate in SOC operations, including on-call rotations, alert investigation, and high-severity incident response.

We are looking for someone who brings strong technical ownership, enjoys solving complex security challenges, and can balance operational execution with strategic improvements and team leadership.

On-call requirement: Availability for one week per month as part of the SOC rotation.

Responsibilities

  • SOC Operations
  • Own and manage the SOC rotating on-call schedule, ensuring 24/7 security coverage and clearly defined escalation procedures.
  • Actively participate in security alert triage, investigation, and incident response alongside the SOC team.
  • Monitor and maintain the operational health and detection coverage of security tools, including SIEM, EDR, and NDR platforms.
  • Define, implement, and continuously improve SOC processes, including alert handling, escalation, SLA adherence, and shift handoffs.
  • Monitor and report key SOC performance indicators, including MTTD, MTTR, false positive rates, and escalation rates.
  • Identify operational inefficiencies and implement improvements to strengthen SOC effectiveness.
  • Detection Engineering
  • Design, develop, tune, and maintain detection rules across Microsoft Sentinel and other security telemetry sources.
  • Write and optimize KQL queries to improve threat detection accuracy and investigation capabilities.
  • Reduce alert fatigue through systematic detection tuning and false positive analysis.
  • Implement and maintain detection-as-code practices, integrating detection rules into CI/CD pipelines when applicable.
  • Develop and maintain detection coverage mappings aligned with the MITRE ATT&CK framework.
  • Continuously evaluate detection gaps and recommend improvements to security monitoring capabilities.
  • Threat Intelligence
  • Oversee the collection, analysis, and operationalization of threat intelligence feeds and reports.
  • Integrate threat intelligence into detection rules, IOC enrichment processes, and incident response playbooks.
  • Apply threat intelligence frameworks such as MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain.
  • Prepare and review threat intelligence briefings for internal teams and client stakeholders.
  • Ensure threat intelligence findings contribute to measurable improvements in detection and response capabilities.
  • Security Incident Response
  • Lead the complete security incident response lifecycle, including triage, containment, eradication, recovery, and post-incident analysis.
  • Act as the technical lead during high-severity security incidents, coordinating response efforts across internal teams and client stakeholders.
  • Develop, maintain, and test incident response playbooks for relevant threat scenarios.
  • Drive post-incident reviews and ensure lessons learned are translated into improvements in detection rules, response procedures, and operational processes.
  • Support the automation of incident response workflows through SOAR platforms and security integrations.
  • Leadership & Continuous Improvement
  • Lead, mentor, and develop SOC analysts and detection engineers, providing technical guidance and career development support.
  • Collaborate with leadership on capacity planning, security tooling strategy, and the evolution of Security Operations capabilities.
  • Establish operational standards and promote consistent security practices across the team.
  • Represent the Security Operations function in client-facing technical discussions when required.
  • Promote the practical adoption of AI-powered security tools to accelerate investigations, improve alert triage, support detection engineering, and streamline threat intelligence analysis.

Requirements

  • 8+ years of experience in Security Operations, including at least 3 years in a technical leadership role.
  • Strong hands-on experience with Microsoft Sentinel, including log onboarding, analytics rules, workbooks, and User and Entity Behavior Analytics (UEBA).
  • Proven experience with the Microsoft Defender suite, including Microsoft Defender for Endpoint (MDE), Defender for Office 365 (MDO), Defender for Identity (MDI), and Defender for Cloud Apps (MDCA).
  • Strong experience writing, optimizing, and tuning KQL detection rules.
  • Deep understanding of the security incident response lifecycle, with direct experience leading investigations and response activities during real security incidents.
  • Working knowledge of threat intelligence frameworks, including MITRE ATT&CK, Diamond Model, and Cyber Kill Chain.
  • Strong understanding of endpoint, network, and cloud telemetry sources and their use in threat detection.
  • Experience managing or coordinating SOC on-call rotations, escalation procedures, and operational workflows.
  • Familiarity with SOAR platforms and security operations automation.
  • Experience with cloud security operations in AWS, Azure, or GCP.
  • Practical experience applying AI or LLM-based tools to security operations, including alert triage assistance, detection rule generation, threat summarization, or investigation acceleration.
  • Experience using tools such as Microsoft Security Copilot, custom GPTs, or equivalent AI-powered solutions.
  • Ability to work independently, manage ambiguity, and make technical decisions in high-pressure environments.
  • Strong communication and stakeholder management skills, with the ability to explain security findings to both technical and non-technical audiences.
  • Professional working proficiency in English, both written and spoken.
  • Availability to participate in the on-call rotation for one week per month.

Nice to have

  • Experience implementing detection-as-code pipelines and version-controlled detection rule management.
  • Exposure to threat hunting methodologies and tools.
  • Relevant certifications such as GCIH, GCFA, GCIA, GDET, SC-200, or equivalent.
  • Experience working in a Managed Security Services Provider (MSSP) or technology consulting environment.

Benefits

  • People First culture
  • Referral Program
  • Free access to streaming platforms
  • Free access to Spotify Premium
  • GYM discount
  • Travel discount
  • E-Learning discount
  • Birthday-day gift
  • Points Program