Managed Security Services Lead

Managed Security Services Lead 

This position is working in a highly reliable IT vendor that provides IT Infrastructure Solutions, Cyber Security, Data Centre Design and Solutions. 

We are seeking an experienced and highly motivated Managed Security Services Analyst/Engineer to join our Security Operations Center (SOC) team. As part of our Managed Security Service Provider (MSSP) offering, you will be responsible for end-to-end real-time threat detection, incident response, automated defense, and security posture improvement for our clients. This position requires the candidate to possess knowledge of Red Team (offensive testing), Blue Team (defensive operations), and Purple Team (collaborative security validation) practices.

Key Responsibilities:

• 24x7 Real-Time Threat Detection & Monitoring
• Continuous Monitoring: Monitor live data streams, logs, events, and activities from EDR, firewalls, network devices, and cloud platforms (Office 365, Azure).
• Incident Identification: Swiftly detect and respond to security threats using advanced analytics and high-fidelity alerting.
• Behavioral Analytics: Actively monitor user/admin behaviors, privilege usage, and policy violations. Ensure real-time detection of unauthorized or abnormal activity.

Incident Response & SOAR Automation

• Automated Playbook Execution: Deploy, manage, and fine-tune SOAR (Security Orchestration, Automation & Response) playbooks; ensure rapid, automated response to verified threats.
• Triage and Escalation: Conduct automated triage using MITRE ATT&CK; escalate unresolved complex incidents for further analysis.
• Remediation Guidance: Provide clear, actionable recommendations for risk mitigation and collaborate with client IT teams for formal incident handling, resolution, and review.
• Ticketing/Workflow Systems: Log and track all incidents in centralized systems with proper audit/compliance controls; coordinate collaborative troubleshooting (e.g., Teams integration).

Security Use Case Tuning & Threat Intelligence Integration

• Risk-Aligned Prioritization: Map and prioritize detection logic to client risk registers and threat models in alignment with frameworks such as MITRE ATT&CK.
• Detection Logic Maintenance: Employ source validation, noise reduction, false positive optimization, and maintain documentation & version control of use cases.
• Red/Purple Team Feedback: Incorporate threat simulation results (e.g., Atomic Red Team, CALDERA) and red/purple teaming feedback to improve efficiency and detection accuracy.
• Metrics & KPIs: Measure and report detection outcomes, conversion rates, time to detect, and other quantitative security metrics.
• Threat Intelligence: Integrate managed CTI feeds and conduct proactive threat hunting to inform control improvements and client recommendations.

Performance Reporting & Client Engagement

• Monthly and Quarterly Reporting: Prepare and present technical and executive security reports, aligning content with NIST and ISO 27002 frameworks, client templates, and evolving needs.
• Review Sessions: Lead quarterly review sessions with client IT teams to discuss findings, answer questions, and align on next steps.
• Continuous Improvement: Proactively update and improve reporting and engagement processes as client requirements evolve.

Advanced Detection, Automation & Vendor Support

• Firewall/Endpoint/Server Monitoring: Design and tune use cases for port scans, DDoS, malware, privilege escalation, process injection, etc.
• Automation: Enrich, block, isolate, and disable malicious activity or accounts through automated workflows.
• Remote Support: Provide incident response and troubleshooting, including after-hours/onsite escalation as necessary.
• Patching & Updates: Coordinate remote firmware/software updates for managed firewall and security devices.

Red, Blue, and Purple Teaming

• Red Team Participation: Perform or support offensive security engagements such as penetration testing, social engineering, and vulnerability assessments.
• Blue Team Operations: Lead or assist with defensive operations including live monitoring, log analysis, SIEM/SOAR rule tuning, and incident remediation.
• Purple Team Collaboration: Work cross-functionally to bridge detection engineering and adversary simulation, integrating red/blue teaming outcomes to continuously improve use case effectiveness and security posture.

Requirements:

• 3+ years’ hands-on experience in SOC, MSSP, or large enterprise security program 
• Bachelor’s degree in Information Security, Computer Science, or related field (or equivalent experience)
• One or more of the following: CISSP, GIAC (e.g., GCIA/GCED), OSCP, CREST, CEH
• Proven track record in threat detection, monitoring, and incident response
• Familiarity with MITRE ATT&CK, NIST, and ISO/IEC 27001/27002
• Demonstrated participation in red/blue/purple team operations and threat simulation
• Experience with SOAR, SIEM (Splunk, QRadar, Sentinel, etc.), EDR, network security
• Strong technical problem-solving, communication, stakeholder engagement skills

Preferred Attributes

• Knowledge of network security, endpoint security, firewall platforms, and cloud (Azure, Office 365).
• Familiarity with automated detection logic, purple/red team pipelines, and hands-on threat hunting.
• Ability to customize detection rules, playbooks, and handle evolving sector-specific IOCs and threats.
• Commitment to continuous improvement, learning, and team-based innovation.