Security Operations Center Architect H/F

As Security Operations Architect, you will build, manage and continuously improve the internal SOC. This is a hands-on leadership role: you will act as a senior L2/L3 incident responder while leading a distributed team across Singapore, London and Houston. You will report to the CISO and act as the primary interface with the outsourced SOC provider.

Key responsibilities

• Lead a team of 4 SOC analysts and engineers across 3 global offices, ensuring consistent 24/7 follow-the-sun coverage
• Define and enforce SOC procedures, escalation paths, shift handovers and KPIs (MTTD, MTTR, false-positive rate)
• Govern the relationship with the outsourced SOC provider and drive continuous service improvement
• Own the detection engineering lifecycle in Microsoft Sentinel (KQL), with coverage mapped to MITRE ATT&CK
• Integrate threat intelligence feeds and drive proactive threat hunting
• Lead triage, investigation, containment, eradication and recovery for complex security incidents
• Coordinate incident response with IT, Legal, Compliance and business units, and run post-incident reviews
• Author, maintain and test playbooks covering phishing, malware, ransomware, BEC, insider threat, cloud compromise and data exfiltration
• Partner with the internal Red Team on purple-team exercises and turn findings into actionable detections
• Report on SOC performance, threat trends and risk posture to the CISO and senior stakeholders
• Mentor and develop the team through structured training plans and hands-on coaching

Your profile

• 4+ years of progressive experience in security operations, incident response or security engineering
• Proven experience leading a SOC team, including remote or distributed staff
• Strong understanding of SOC operating models (tiered, hybrid, follow-the-sun)
• Track record of building or significantly improving detection and response capabilities
• Excellent communication skills, with the ability to translate technical findings for executive audiences
• Fluent english

Technical environment

• SIEM: Microsoft Sentinel (KQL), log source onboarding, analytics rules, workbooks
• EDR and XDR: Microsoft Defender for Endpoint, CrowdStrike Falcon
• Cloud: AWS (GuardDuty, CloudTrail, Security Hub), Azure (Defender for Cloud, Entra ID Protection), Wiz
• Data security: Microsoft Purview, Varonis
• Network: Zscaler (ZIA/ZPA), Palo Alto Networks (NGFW, Panorama, Cortex)
• Incident response: digital forensics, malware analysis, memory and disk acquisition
• Frameworks: MITRE ATT&CK, NIST CSF, NIST 800-61