ARCHITECT - SOC Monitoring

Job Description – SOC Incident Response + Threat Intelligence / Threat Hunting (L4) Position Title L4 Security Lead – SOC Incident Response, Threat Intelligence & Threat Hunting Experience 15+ years in Cyber Security Operations, Incident Response, Threat Intelligence, and Threat Hunting Location Flexible / Hybrid / Onsite Role Summary We are looking for an experienced L4 SOC Security Lead with strong expertise in Incident Response (IR), Threat Intelligence (TI), and proactive Threat Hunting. The candidate will act as a senior escalation point for high-severity security incidents, conduct advanced investigations, develop threat hunting hypotheses, and provide actionable intelligence to improve the organization’s overall security posture. The role requires hands-on expertise across SIEM, EDR/XDR, network security monitoring, malware analysis, threat intelligence platforms, and cloud security monitoring. Key Responsibilities Incident Response & Security Operations Lead investigation and response activities for complex security incidents including: Ransomware Advanced Persistent Threats (APT) Insider threats Credential compromise Web application attacks Cloud security incidents Data exfiltration Lateral movement Privilege escalation Perform advanced triage and root cause analysis using: SIEM EDR/XDR Network telemetry Threat intelligence feeds Cloud logs Endpoint forensics Leading the IR activity overall and managing client escalations Conduct incident containment, eradication, and recovery coordination. Develop and improve: Incident response playbooks Detection use cases Correlation rules SOC runbooks Automation workflows Coordinate with infrastructure, cloud, application, and business teams during major incidents. Prepare executive and technical incident reports with actionable recommendations. Threat Intelligence Responsibilities Monitor and analyze cyber threat intelligence from: Commercial TI platforms Open-source intelligence (OSINT) Government/CERT advisories Dark web monitoring Vendor threat reports Enrich alerts with Indicators of Compromise (IOCs), TTPs, malware intelligence, and adversary attribution. Map adversary activities to: MITRE ATT&CK Cyber Kill Chain Diamond Model Analyze emerging threats, zero-days, ransomware campaigns, and targeted attack trends. Provide strategic and operational threat advisories to SOC and leadership teams. Create threat intelligence reports, executive summaries, and threat landscape assessments. Threat Hunting Responsibilities Conduct proactive threat hunting using hypothesis-driven methodologies. Hunt for: Persistence mechanisms Beaconing activity Credential dumping Living-off-the-land (LOLBins) Command & Control (C2) Suspicious PowerShell activity Lateral movement Cloud anomalies Use telemetry from: SIEM EDR/XDR DNS Proxy Firewall Identity systems Cloud platforms Develop custom queries and analytics for detecting stealthy attacker behavior. Identify detection gaps and recommend logging improvements. Convert hunt findings into production-grade detection use cases. Required Technical Skills SIEM & Security Monitoring Strong hands-on experience with one or more: IBM QRadar Microsoft Sentinel Splunk Enterprise Security ArcSight LogRhythm EDR/XDR Technologies Experience with: CrowdStrike Falcon Microsoft Defender for Endpoint SentinelOne Palo Alto Cortex XDR Threat Intelligence Platforms Experience with: Recorded Future Anomali ThreatStream MISP ThreatConnect Cloud & Infrastructure Security Knowledge of: Amazon Web Services security monitoring Microsoft Azure security services Google Cloud Platform logging and detections Identity security and IAM monitoring Container/Kubernetes security basics Investigation & Analysis Skills Malware triage and behavioural analysis Windows/Linux forensic analysis Memory and disk artifact analysis Packet analysis using Wireshark Threat actor TTP analysis IOC enrichment and validation Scripting & Automation Good knowledge of: Python PowerShell KQL SPL Regex API integrations SOAR automation Desired Certifications Preferred certifications include: GIAC Certified Incident Handler (GCIH) GIAC Certified Forensic Analyst (GCFA) GIAC Certified Intrusion Analyst (GCIA) Certified Threat Intelligence Analyst (CTIA) EC-Council Certified Ethical Hacker (CEH) ISC2 CISSP Security vendor certifications Key Competencies Strong analytical and investigative mindset Excellent communication and stakeholder management Ability to work during high-pressure incidents Deep understanding of attacker methodologies Strong documentation and reporting capability Mentoring and guidance for junior analysts Ability to independently lead investigations Preferred Exposure MDR/MSSP environment Healthcare / BFSI / Critical infrastructure domains Threat hunting frameworks Purple team exercises MITRE ATT&CK-based detection engineering SOAR platforms and automation Cloud-native SOC operations Typical Deliverables Incident investigation reports / RCA Threat intelligence advisories Hunting reports and findings Detection use cases IOC/TTP repositories / MITRE Executive risk summaries Threat landscape assessments SOC maturity improvement recommendations Presentation skills Communication skills