SOC & Backup Team Lead

Please Read carefully - Failure to Follow the Instructions Will Not Be Entertained

Email your updated resume in pdf - ----------

Job Title: Workspace Analyst

Full-time 9 AM to 5 PM EST Mondays - Fridays

Rate: $5/hour + perks and beneffits - salary is bi-weekly

Job Description:
The SOC & Backup Team Leader is responsible for leading and overseeing the Security Operations Center (SOC) and Backup functions across all managed environments. This role provides technical leadership, escalation support, quality assurance, operational oversight, and continuous improvement for security monitoring, i ---------- response, security posture, backup protection, and related service delivery. The Team Leader ensures that technicians have the knowledge, tools, procedures, and direction required to investigate and resolve issues properly, while maintaining appropriate documentation, SLA performance, client protection, and operational standards.

Roles and Responsibilities:
Team Leadership & Development: Lead and coordinate the SOC and Backup teams, assign responsibilities, monitor workload and completion, coach technicians, provide technical guidance and performance feedback, and enforce established processes and service expectations. Technical Escalation: Serve as a primary escalation point for complex SOC and Backup issues. Review escalated tickets and investigations, validate troubleshooting and findings, identify missing investigation steps, provide technical direction, determine appropriate remediation, and coordinate escalation to different departments, management, or vendors when required. SOC Operations Oversight: Maintain working knowledge of Datto EDR/AV, BullPhish ID, DarkWeb ID, INKY, SaaS Alerts, ConnectSecure, RocketCyber, DUO, VPenTest, and Datto RMM SOC Dashboard operations. Oversee alerts involving malware, phishing, compromised accounts, suspicious activity, vulnerabilities, exposed credentials, MFA/security issues, endpoint protection gaps, and other cybersecurity concerns. Alert Optimization: Review alert volumes, severity, false positives, duplicate or recurring alerts, thresholds, detection rules, exclusions, suppressions, integrations, and automated ticket creation. Tune alerting and workflows to reduce unnecessary noise and ticket volume without reducing visibility into legitimate security events. I ---------- Response & I ---------- Report Review: Review significant security i ---------- and i ---------- reports to validate investigation quality, evidence, findings, actions taken, containment, remediation, communication, and final outcome. Identify gaps, recurring attack patterns, and additional preventive actions required. Security Posture & Compliance Oversight: Review security posture and control gaps including EDR/AV coverage, third-party antivirus, MFA, risky sign-ins, vulnerabilities, exposed credentials, email security, and other security requirements. Support cybersecurity insurance readiness by reviewing applicable security controls, documentation, and evidence requirements. Backup Operations Oversight: Oversee Uniview, Spanning, and Synology C2 operations, including backup coverage, failures, retention, storage/capacity concerns, restore requirements, recurring issues, and escalations. Ensure devices and services remain protected and recoverable. Quality Assurance & Documentation: Review tickets, i ---------- reports, investigations, backup records, and technician documentation for completeness, accuracy, appropriate troubleshooting, evidence, resolution, and adherence to SOPs. Provide corrective coaching when work does not meet established standards. Process & SOP Management: Develop, maintain, and enforce SOC and Backup SOPs, checklists, workflows, escalation procedures, ticketing standards, alert optimization processes, audit procedures, and remediation playbooks. Reporting & Operational Oversight: Review SLA performance, ticket queues, alert trends, backup status, security metrics, workload, recurring issues, and operational risks. Communicate significant trends and recommendations to management and coordinate corrective actions. Continuous Improvement: Identify opportunities for automation, alert tuning, workflow improvements, reduction of repetitive work, improved documentation, stronger security controls, improved backup coverage, and more consistent service delivery.

Qualification:
3+ years of experience in IT operations, cybersecurity/SOC, managed services, or a related technical environment. At least 1–2 years of experience in a senior, lead, escalation, or supervisory capacity. Proven experience overseeing cybersecurity operations, backup operations, technical escalations, and service delivery within an MSP or similar environment. Hands-on experience with security monitoring, i ---------- response, alert management, endpoint security, vulnerability management, backup platforms, and security tool administration. Experience reviewing security i ---------- , investigations, i ---------- reports, technical documentation, and remediation activities. Experience optimizing security alerts, detection rules, thresholds, exclusions, suppressions, ticket automation, and monitoring workflows. Experience coaching and developing technical team members while maintaining quality, SLA, and process standards. Experience developing, implementing, and improving SOPs, workflows, checklists, and operational processes. Experience working with vendors, internal technical teams, management, and clients during complex technical or security escalations. Ability to prioritize high-severity i ---------- , competing escalations, team workload, and operational requirements in a fast-paced MSP environment.

Experience:
Proven experience in an MSP, SOC, cybersecurity operations, IT operations, or related technical environment with responsibility for security monitoring, i ---------- response, backup, or service delivery. Hands-on experience investigating security alerts and i ---------- , reviewing endpoint and account activity, handling phishing or compromised-account cases, evaluating vulnerabilities, and coordinating remediation. Demonstrated experience serving as a technical escalation point and providing direction to technicians on complex security and backup issues. Experience reviewing tickets, i ---------- reports, investigation notes, logs, dashboards, audit records, evidence, and remediation activities to determine whether work is complete and technically appropriate. Experience optimizing security alerts through rule tuning, thresholds, exclusions, suppressions, prioritization, and automation, with an understanding of how configuration changes affect alert visibility and ticket generation. Experience overseeing backup environments, reviewing backup failures and coverage, validating backup health, managing capacity concerns, coordinating restores, and escalating data-protection risks. Experience leading, coaching, mentoring, and evaluating technical team members, including providing corrective feedback and reinforcing SOP and documentation requirements. Experience developing, implementing, and improving SOPs, checklists, workflows, escalation procedures, remediation playbooks, and operational standards. Experience monitoring SLA performance, ticket queues, KPIs, workload, recurring issues, and service quality in a managed-services or similar environment. Experience coordinating with different departments, including EUS, Infrastructure, Account Management, Management, and other technical or operational teams, as well as vendors and clients, during escalations and service-impacting security or backup issues. Demonstrated ability to work under pressure, prioritize high-impact issues, make informed technical decisions, manage competing operational priorities, and maintain accountability for unresolved risks. Experience identifying recurring operational problems and converting findings into process improvements, automation opportunities, configuration changes, training needs, or updated procedures.