Security Operations Lead

About the role

Vitol is seeking an experienced Security Operations Lead to build, manage and continuously improve its internal Security Operations Centre. Based in Geneva (or London) the role combines hands‑on cyber defence with leadership of a distributed team across Singapore, London and Houston.

Key responsibilities

• Lead a team of four SOC analysts/engineers, ensuring 24/7 coverage, defining procedures, escalation paths and performance metrics.
• Own the detection engineering lifecycle in Microsoft Sentinel (KQL) and maintain analytics, correlation logic and custom detections mapped to MITRE ATT&CK.
• Act as senior incident responder (L2/L3), coordinating cross‑functional response, conducting post‑incident reviews and improving playbooks.
• Manage the outsourced SOC provider relationship, governing service performance and driving continuous improvement.
• Partner with the internal Red Team for purple‑team exercises, translating findings into detection rules and response procedures.

Required profile

• 4+ years progressive experience in cybersecurity operations, incident response or security engineering.
• Proven experience leading or managing a distributed SOC team.
• Strong communication and stakeholder‑management skills, able to present technical findings to senior executives.
• Experience in the commodity trading, energy or financial services sector is a plus.

Required skills

• SIEM & analytics: Microsoft Sentinel (KQL), log source onboarding, analytics rule development.
• Endpoint security: Microsoft Defender for Endpoint, CrowdStrike Falcon.
• Cloud security: AWS GuardDuty, CloudTrail, Security Hub; Microsoft Azure Defender, Entra ID Protection; Wiz CSPM.
• Data security & DLP: Microsoft Purview, Varonis.
• Network & web security: Zscaler, Palo Alto Networks (NGFW, Panorama, Cortex).
• Scripting/automation: Python, PowerShell, KQL; familiarity with SOAR platforms.