SOC Technical Authority / Expert Service Operations Security

About the role

SITA is looking for a SOC Technical Authority to provide expert technical leadership across SOC operations, major security investigations, detection engineering, automation and continuous SOC maturity improvement. Reporting to the Senior Manager, Service Operations, you will ensure the technical quality of security monitoring, triage, investigation, escalation, detection coverage and automation, and protect the organization through advanced security monitoring, threat detection and incident escalation.

Key responsibilities

• Act as the highest technical escalation point for SOC investigations, monitoring and high-severity security events.
• Lead advanced security investigations by analysing endpoint activity, network events, security telemetry and investigative evidence.
• Mentor SOC Analysts and Senior SOC Analysts in day-to-day operations and complex investigations.
• Own and improve the technical quality of monitoring, triage, investigation, escalation and detection coverage.
• Lead detection engineering: design, implement, validate, tune and improve detection use cases, correlation rules, analytics and monitoring content, mapped against the MITRE ATT&CK framework.
• Improve SIEM, SOAR, XDR and security monitoring integrations through automation workflows.
• Leverage threat intelligence to strengthen monitoring, detection, investigation and response.
• Prepare technical reports, detection gap assessments, operational metrics and security recommendations for SOC leadership.
• Collaborate with SIRT and security teams during incident escalations, audits, cyber simulations and security assessments.

Required profile

• 5 to 8 years of experience in Security Operations or Cyber Defense, including at least 3 years in a SOC role.
• Bachelor's degree in IT, Cybersecurity, Computer Science or a related field.
• At least one recognized cybersecurity certification such as CISSP, GCIH, GCIA, SC-200, CySA+ or ECIH.
• Nice to have: experience evaluating, testing and implementing new security technologies, and taking part in tabletop exercises, cyber simulations, audits and assessments.

Required skills

• Expert knowledge of SIEM, SOAR and XDR platforms, ideally Elastic, Cortex, Microsoft Defender and CrowdStrike.
• Hands-on experience with Python, PowerShell, APIs and security automation.
• Knowledge of Azure or cloud security, identity security and enterprise security environments.
• Practical application of the MITRE ATT&CK framework and use of threat intelligence.

What we offer

• Flex Week: up to 2 days per week working from home.
• Flex Day and Flex-Location: up to 30 days a year working from anywhere in the world.
• Employee Assistance Program and Champion Health.
• Professional development through platforms such as LinkedIn Learning, Pluralsight, Harvard Business Publishing and Stanford.
• Competitive benefits tailored to local market and employment status.