SOC Development Lead

About the role

The SOC Development Lead is responsible for end‑to‑end delivery of SOC Development services across all customers, ensuring alignment with MSSP service scope and SLAs. This role owns the lifecycle of SIEM platforms, from onboarding to reporting, and drives detection engineering maturity.

Key responsibilities

• Accountable for delivery of SOC Development services, ensuring compliance with NCA ECC and audit readiness.
• Own SIEM platform lifecycle: onboarding, parsing, normalization, use case development, and reporting.
• Maintain availability, performance, and integrity of SIEM infrastructure and integrations.
• Drive continuous improvement of use case effectiveness and MITRE ATT&CK coverage.
• Act as primary escalation point for SOC Development‑related issues impacting service delivery.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, IT or related field; Master’s preferred.
• Minimum 5 years of relevant experience in SOC development, SIEM/TIP implementation, and MSSP content creation.
• Professional certifications such as CISSP, CISA, Splunk Enterprise Security Certified Admin, Splunk Certified Developer, Splunk Enterprise Certified Architect.

Required skills

• Advanced proficiency with Splunk and Anomali platforms.
• SIEM and TIP architecture design, implementation, and configuration.
• Log source integration, onboarding, and normalization.
• Use case development, tuning, and dashboard visualization.
• Cybersecurity incident handling and response.
• Security content development for MSSP environments.
• Knowledge of MITRE ATT&CK framework and latest threat campaigns.