SOC Team Lead

Company overview

We support about 60 local businesses, most within 30 minutes of the office. Clients have the owner's cell number, and the owner still takes the occasional Saturday call. Lunch is usually whatever is closest to the client site.

Elbe Managed Services has an opening for an SOC Team Lead. This role handles alert triage, phishing investigations and vulnerability tracking for about 3,000 endpoints. Our headquarters is in Munich, and about a third of the team works remotely from other countries. You will join as an independent contractor on a long-term agreement. Payment is monthly in USD. Working hours overlap with Central European Time. You get a company laptop and a headset before you start.

Day to day

Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM. Analyse reported phishing emails, check headers and URLs, and purge malicious messages. Check threat intelligence feeds and IOCs against our environment. Review firewall, proxy, VPN and authentication logs for suspicious activity. Write and update SOC runbooks and playbooks. Escalate confirmed incidents and follow the incident response plan. Investigate endpoint alerts in CrowdStrike Falcon, SentinelOne or Defender for Endpoint.

Qualifications

8+ years in an SOC, security analyst or IT security role. Familiarity with the MITRE ATT&CK framework. Must be able to pass a background check. Ability to work shifts, including some nights, weekends or holidays as scheduled.

Preferred

SOAR platforms such as Splunk SOAR, Cortex XSOAR or Tines. Cloud log analysis (CloudTrail, Entra ID sign-in logs).

Schedule: Day shift with one week of on-call every six weeks

What you get

Company laptop. Annual rate review.

Duration: 6 months. Start: Within 30 days.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Elbe Managed Services.