Security Operations Lead – SOC Architect

About the role

Our client is seeking a Security Operations Lead to build, run and continuously improve an internal Security Operations Centre. Based in Geneva (with possible London location), you will combine hands‑on cyber defence as a senior L2/L3 incident handler with leadership of a distributed SOC team.

Key responsibilities

• Lead and develop a 24/7 follow‑the‑sun SOC team, ensuring consistent service quality.
• Define SOC procedures, escalation paths, shift handovers and KPIs such as MTTD, MTTR and false‑positive rate.
• Act as the main interface with the outsourced SOC provider, monitor performance and drive improvements.
• Own the detection engineering lifecycle in Microsoft Sentinel (KQL) and map coverage to MITRE ATT&CK.
• Integrate threat intelligence feeds and lead proactive threat hunting activities.
• Lead complex incident response from triage to recovery, coordinating with IT, Legal and Compliance.
• Conduct post‑incident reviews, root‑cause analysis and translate findings into new detections and process updates.
• Write and test playbooks and runbooks for phishing, ransomware, BEC, insider threat, cloud compromise and data exfiltration.
• Run tabletop and purple‑team exercises with the internal Red Team.
• Report SOC performance, threat landscape and risk posture to the CISO and senior stakeholders.

Required profile

• 4+ years of experience in cybersecurity operations, incident response or security engineering.
• Proven experience leading a SOC team, including remote or distributed staff.
• Solid understanding of SOC operating models (tiered, hybrid, follow‑the‑sun).
• Strong communication skills, able to explain technical findings to executives.

Required skills

• Microsoft Sentinel (KQL), Defender for Endpoint, CrowdStrike Falcon.
• Cloud security on AWS (GuardDuty, CloudTrail, Security Hub) and Azure (Defender for Cloud, Entra ID Protection), plus Wiz.
• Microsoft Purview, Varonis, Zscaler (ZIA/ZPA), Palo Alto Networks NGFW, Panorama, Cortex.
• Digital forensics, malware analysis, NIST CSF and NIST 800‑61.
• SOAR platforms, Python and PowerShell scripting.