SOC Lead

• Proven experience running or leading a SOC or equivalent detection-and-response function, including shift-based or extended-hours coverage models and on-call rotations.
• Strong hands-on incident response background - triage, containment and coordination of multi-team incidents under time pressure.
• Experience building or maturing SOC processes: runbooks, SLAs, escalation paths and metrics (MTTA, MTTR/triage time, escalation accuracy).
• Comfort working across a dependency-heavy environment - partnering with Detection Engineering, Forensics, Security Platform Engineering and VulnOps rather than owning every input yourself.
• Experience designing or running tabletop exercises with cross-functional stakeholders (IT, business, Legal, Communications).
• People leadership experience, ideally managing senior/principal-level engineers.
• Clear communicator, comfortable escalating to and coordinating with technical and business stakeholders during live incidents.

We are on a mission to pioneer the world's next era of play. As we grow across Europe and Latin America, we're building The Playstack - the technology powering the next generation of sports, gaming, and fan experiences. Join us, and help make it the most widely used platform in the world! From operations, to marketing, to product, we are looking for talented people who will shape how millions of customers play, watch, and connect every day.

SOC Lead

The Security Operations Centre (SOC) is the front line of Super Technologies' security organisation, monitoring, triaging and providing first response to alerts around the clock, with an on-call rotation covering extended hours. As SOC Lead, you'll own alert monitoring, triage, first-line incident response and major-incident coordination across the organisation, building the team's coverage model, runbooks and metrics whilst working closely with Detection Engineering, Forensics, Security Platform Engineering and VulnOps. This is a hands-on leadership role, combining team management with staying close to the operational work - shift coverage, incident ownership and the tooling needed to contain threats quickly.

Monitoring, triage and first response

• Own alert monitoring, triage and first-line response across all detection sources, on an extended-hours shift pattern with out-of-hours on-call.
• Define SOC runbooks, coverage metrics and SLAs for alert acknowledgement and triage, and feed alert-noise data back to Detection Engineering for tuning.

Logging and detection coverage

• Ensure logging coverage exists across the organisation, so Detection Engineering and Forensics have what they need to work from.

Incident ownership

• Own incidents end-to-end - enrich, validate, contain and close - escalating to Forensics once confirmed, whilst building the capability to contain any incident anywhere in the organisation within seconds.

Major incident coordination

• Coordinate major security incidents across SOC, Infrastructure, Cloud, Identity and business teams, and own major-incident tabletop exercises across Security, IT, business, Legal and Communications.
• Capture lessons learned and drive updates to IR playbooks, escalation paths and decision-making procedures.

IR playbooks and testing

• Own IR playbooks and work with the pentest team to test alerting coverage and the SOC's reaction time.