Velocity Operations Team Lead

Our client is a top-tier cyber consulting and incident response company, working with organizations worldwide to proactively build their cyber resilience, and to respond to and defeat cyber attacks. Sygnia is a trusted advisor of IT and security teams, senior managements, and boards of top organizations, including Fortune 100 companies. It is currently seeking a Velocity Operations Team Lead to join their expanding team.

Responsibilities:

• Lead, manage, and professionally develop a team of MDR Analysts, providing ongoing technical coaching, mentoring, and performance feedback.
• Manage team scheduling,shift coverage, and on-call allocation to support 24/7 Follow-the-Sun operations.
• Serve as the senior technical escalation point for complex investigations and high-severity security events.
• Manage alert queues and priorities, ensuring acknowledgement, investigation, and escalation are handled in accordance with client SLAs.
• Monitor operationa lperformance, identify potential SLA risks or bottlenecks, and proactively rebalance workloads when required.
• Ensure effective cross-region shift handovers, including open investigations, client communications, and outstanding operational tasks.
• Lead and support in-depth security investigations, including log-based forensic analysis across endpoint,network, identity, email, cloud, and application environments.
• Continuously improve detection capabilities by tuning existing logic, reducing false positives, and translating threat intelligence and post-incident findings into new or enhanced detections.
• Review analysts’investigations, escalations, reports, and client communications to ensure technical accuracy, completeness, consistency, and professionalism.
• Act as a technical point of contact for clients during security events, clearly communicating findings,risks, status updates, and recommended actions to both technical and non-technical stakeholders.
• Produce and review client-ready incident and investigation reports, including timelines, root cause, impact assessments, and remediation recommendations.
• Serve as the focal point between MDR and Incident Response teams when critical events require transition to full Incident Response.
• Develop and maintain MDR procedures, runbooks, knowledge articles, and client-specific documentation.
• Identify opportunities to improve MDR processes, methodologies, and operational efficiency.
• Support the MDR Site Manager with ongoing operational activities and act on their behalf when required.

Requirements:

• 5+ years of hands-on experience in SOC, MDR, or MSSP environments, including security monitoring, investigation, detection, and incident response.
• 1+ years of experience leading or directly managing security analysts, including technical mentoring, performance management, and shift or resource planning.
• Strong hands-on investigation experience across SIEM, EDR/XDR, network, identity, email, cloud,and endpoint telemetry.
• Experience with forensic and incident response investigations, including host, network, and cloud log analysis.
• Strong understanding of security threats, attacker behavior, investigation methodologies, and incident response processes.
• Experience building,tuning, and improving detection scenarios and correlation logic.
• Hands-on experience investigating security events in at least one major cloud platform (AWS, Azure,or GCP).
• Experience analyzing network security telemetry, including firewalls, WAF, proxy, and DNS logs.
• Experience investigatingEDR/XDR, Windows, Sysmon, identity, and email security telemetry.
• Familiarity with malware analysis and threat intelligence enrichment.
• Proven ability to produce high-quality incident and investigation reports for external clients.
• Experience working in a 24/7 or Follow-the-Sun operational environment.
• Strong leadership and coaching capabilities, with the ability to develop analysts while maintaining high technical and operational standards.
• Excellent written and verbal English, with the confidence to lead technical discussions with clients,including during high-pressure incidents.
• Demonstrates initiative, accountability and a continuous improvement approach
• Able to provide support for critical security escalations outside regular working hours, in accordance with operational requirements
  Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.

We regret that only shortlisted candidates will be notified.

EALicense No.: 08C3209

RegistrationNo.: R1101742