Department: Security Operations
Reports To: SOC Manager
Employment Type: Full-Time, Exempt
Work Location: Onsite, Huntsville, Alabama (MAD Security headquarters and 24/7 SOC). Weekday business hours with scheduled on-call. Not remote.
Travel Requirements: Occasional travel for client meetings and industry events
Position SummaryThe SOC Technical Lead owns the technical standard MAD Security's 24/7 SOC operates against and keeps the platform fit to deliver the service. You are responsible for detection content, the security platform, incident command, and the outcome of engineering projects.
You lead the Tier 3 analysts and work alongside the SOC Desk Manager, who runs day-to-day operations, supporting our clients from Huntsville, Alabama. MAD Security integrates, engineers, and tunes best-of-breed tooling, with Elastic Security on Elastic Cloud Gov at the center, and your team makes sure those systems are ready and detections are tuned.
Primary Responsibilities - Own the SOC platform and its integrations, including stability, performance at scale, and change approval.
- Own the detection content standard and rule review standard; maintain validated detection coverage.
- Write and publish SOC technical standards; approve architecture and platform changes and deviations.
- Serve as incident commander on declared incidents, or as backup to the team member who does, including scoping, containment decisions, and evidence handling.
- Own the outcome of engineering projects, platform stability, and tool integration.
- Own technical testing (penetration testing) execution, reporting, and project management: scope and schedule engagements, manage them to a quality standard, and present findings and remediation to clients.
- Lead, coach, and develop the Tier 3 analysts, and ensure each understands the Tier 2 and Tier 1 roles their work supports.
- Own detection engineering, and engineer AI-assisted triage and response with human oversight on critical decisions.
- Communicate with technical, executive, and client audiences during and after incidents.
What Success Looks Like in the First 12 Months - Platform stability, ingestion, and retention are managed to a published standard with a working change and deviation process.
- Every production detection has passed peer review against a written standard, detections are managed as code, and coverage is validated on a schedule.
- Declared incidents have a commander, documented containment decisions, preserved evidence, and a recorded improvement afterward.
- Engineering projects are delivered end to end, and every Tier 3 analyst understands the Tier 2 and Tier 1 roles their work supports.
- Penetration testing engagements are delivered on schedule to a quality standard you set, and clients receive findings they understand and act on.
- Agentic triage is in production with a defined oversight boundary, and false positives and alert-to-notify time are down from baseline.
- Recurring cross-client problems are solved at the platform level.
Required Qualifications Experience - Minimum eight years in information security and/or IT, including significant SOC experience as a senior or lead analyst, detection engineer, or security architect.
- Able to serve as incident commander on declared incidents, or as backup to one, including scoping, containment decisions, and evidence handling.
- Experience operating a SIEM platform at scale across multiple clients or business units.
Education - Bachelor's degree in Information Technology, Information Security, Computer Science, or equivalent experience.
Technical Qualifications - Deep expertise in detection engineering, incident response, threat hunting, platform administration, and security architecture.
- Expert knowledge of SIEM platforms, including ingestion, retention, integrations, and performance at scale.
- Ability to write technical standards others can follow; familiarity with AI and automation in a SOC with sound judgment about human oversight.
- Working knowledge of penetration testing methodology and deliverables sufficient to scope an engagement, judge the quality of a test, and present findings to a client.
Required Certifications - None required. CISSP, CompTIA SecurityX (formerly CASP+), or CCSP strongly preferred.
Preferred Qualifications - CISSP, CompTIA SecurityX, or CCSP; GCIA, GCFA, GCIH, or GDAT as alternates.
- Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
- Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
- Experience leading a technical team in an MSP/MSSP.
Capabilities and Professional Attributes - Technical authority who writes standards and enforces review gates.
- Decisive under pressure; records reasoning and holds to decisions.
- Develops senior engineers and shares knowledge down the tiers.
- Integrity: ethical and respectful to clients and team.
- Grit: self-motivates, self-manages, and meets deadlines when faced with competing priorities.
- Customer-centric: partnership with our clients is a win-win scenario.
- Selfless: when one team member succeeds, we all succeed.
Work Environment - Onsite in Huntsville, Alabama, in an office setting within the 24/7 SOC.
- Weekday business hours, with scheduled on-call.
- Client-facing during and after incidents and on technical service matters.
- Occasional travel for client meetings and industry events.
- Must be a U.S. person; the SOC is staffed by U.S. personnel.
- Physical demands are representative of an office environment.
Other Duties It is not a comprehensive list of duties, responsibilities, and qualifications. MAD Security, LLC reserves the right to amend responsibilities to meet business and organizational needs, with or without notice.
