Lead role for the L1 SecOps Command Center, covering security event monitoring, triage and shift supervision.
Support level L1 Lead Domain SecOps Command Center (L1) Scope 24x7 Security Monitoring, Alert Triage, Escalation & Shift Leadership
Lead and manage the L1 SecOps Command Center. Ensure consistent security monitoring, triage and escalation across shifts, while supervising the on-floor analyst team.
Process
Command Center Leadership
• Supervise the SecOps Command Center analysts across shifts, including rosters and shift
handover.
• Own the shift schedule and make sure 24x7 security monitoring coverage has no gaps.
• Coach analysts on triage quality, tool use and SOP adherence.
• Review shift performance: alert volume, response times and missed alerts.
• Stakeholder Management, collaboration with different teams and attend the MIM meetings in
case of P1/P2 incidents
• Be the point of escalation when an analyst cannot resolve or classify a security alert.
Monitoring and Triage
• Oversee continuous monitoring of security alerts across endpoint, network, DLP and identity
tools. Analyze the alerts to reduce duplicate alerts/noise suppression and optimize the alerts.
• Confirm alerts are triaged, enriched and routed to the correct Application/MIM/Infra/L2 security
tower within the target time if not resolved on the SOPs/Runbooks.
• Check service and endpoint availability monitoring, including agent health and coverage.
• Confirm ServiceNow tickets are raised, updated and closed with clear notes/logs.
• Escalate confirmed security incidents to the client's security team promptly, with evidence and
recommended action.
Reporting and Improvement
• Produce and review the daily and weekly SecOps Command Center status report for
leadership.
• Assist MIM to Run RCA and post-incident reviews for major or repeated security incidents.
• Keep SOPs, escalation matrices and knowledge-base articles current.
• Track and report on SLA and KPI performance for the Command Center.
Common
• Keep ServiceNow tickets and dashboards current, with clear resolution and closure notes.
• Work with DLP, Malware Tools, Network Security and IDAM leads on process and tooling
changes.
Tools
• ServiceNow - ITSM
• Data Monitoring Tools
• SIEM or security monitoring platform (Splunk)
• Zscaler
• Endpoint (Jamf) and network security consoles (read access)
• Dashboarding and reporting tools
Tools
• Shift roster and workforce management tools
Technologies
• Windows Bit Locker for Laptop and basic knowledge of Network Sec
Windows Bit Locker for Laptop and basic knowledge of Network Security, IDAM, Malware &
DLP
• Security event monitoring, triage including diagnose & validate
• Endpoint and service availability monitoring
• ITSM incident, problem and change processes
• Shift and workforce management
• SLA and KPI reporting
• RCA and continuous improvement
Experience
• 10+ Years of experience in a 24x7 Security Operations Center environment
• Experience leading or supervising a shift-based security monitoring team
• Knowledge of cybersecurity fundamentals.
• Security alert triage and escalation across endpoint, network and identity tools
• ServiceNow or similar ITSM tool administration
• SLA/KPI reporting and RCA facilitation
• Clear written and spoken English, including leadership reporting
Preferred Certifications
• ITIL Foundation
• CompTIA Security+
• GIAC Security Essentials (GSEC) or equivalent SOC certification