Security Operations Center (SOC) Technical Lead

Department: Security Operations Reports To: SOC Manager Employment Type: Full-Time, Exempt Work Location: Onsite, Huntsville, Alabama (MAD Security headquarters and 24/7 SOC). Weekday business hours with scheduled on-call. Not remote. Travel Requirements: Occasional travel for client meetings and industry events Position Summary

The SOC Technical Lead owns the technical standard MAD Security's 24/7 SOC operates against and keeps the platform fit to deliver the service. You are responsible for detection content, the security platform, incident command, and the outcome of engineering projects. You lead the Tier 3 analysts and work alongside the SOC Desk Manager, who runs day-to-day operations, supporting our clients from Huntsville, Alabama. MAD Security integrates, engineers, and tunes best-of-breed tooling, with Elastic Security on Elastic Cloud Gov at the center, and your team makes sure those systems are ready and detections are tuned. Primary Responsibilities

• Own the SOC platform and its integrations, including stability, performance at scale, and change approval.
• Own the detection content standard and rule review standard; maintain validated detection coverage.
• Write and publish SOC technical standards; approve architecture and platform changes and deviations.
• Serve as incident commander on declared incidents, or as backup to the team member who does, including scoping, containment decisions, and evidence handling.
• Own the outcome of engineering projects, platform stability, and tool integration.
• Own technical testing (penetration testing) execution, reporting, and project management: scope and schedule engagements, manage them to a quality standard, and present findings and remediation to clients.
• Lead, coach, and develop the Tier 3 analysts, and ensure each understands the Tier 2 and Tier 1 roles their work supports.
• Own detection engineering, and engineer AI-assisted triage and response with human oversight on critical decisions.
• Communicate with technical, executive, and client audiences during and after incidents.

What Success Looks Like in the First 12 Months

• Platform stability, ingestion, and retention are managed to a published standard with a working change and deviation process.
• Every production detection has passed peer review against a written standard, detections are managed as code, and coverage is validated on a schedule.
• Declared incidents have a commander, documented containment decisions, preserved evidence, and a recorded improvement afterward.
• Engineering projects are delivered end to end, and every Tier 3 analyst understands the Tier 2 and Tier 1 roles their work supports.
• Penetration testing engagements are delivered on schedule to a quality standard you set, and clients receive findings they understand and act on.
• Agentic triage is in production with a defined oversight boundary, and false positives and alert-to-notify time are down from baseline.
• Recurring cross-client problems are solved at the platform level.

Required Qualifications Experience

• Minimum eight years in information security and/or IT, including significant SOC experience as a senior or lead analyst, detection engineer, or security architect.
• Able to serve as incident commander on declared incidents, or as backup to one, including scoping, containment decisions, and evidence handling.
• Experience operating a SIEM platform at scale across multiple clients or business units.

Education

• Bachelor's degree in Information Technology, Information Security, Computer Science, or equivalent experience.

Technical Qualifications

• Deep expertise in detection engineering, incident response, threat hunting, platform administration, and security architecture.
• Expert knowledge of SIEM platforms, including ingestion, retention, integrations, and performance at scale.
• Ability to write technical standards others can follow; familiarity with AI and automation in a SOC with sound judgment about human oversight.
• Working knowledge of penetration testing methodology and deliverables sufficient to scope an engagement, judge the quality of a test, and present findings to a client.

Required Certifications

• None required. CISSP, CompTIA SecurityX (formerly CASP+), or CCSP strongly preferred.

Preferred Qualifications

• CISSP, CompTIA SecurityX, or CCSP; GCIA, GCFA, GCIH, or GDAT as alternates.
• Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
• Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
• Experience leading a technical team in an MSP/MSSP.

Capabilities and Professional Attributes

• Technical authority who writes standards and enforces review gates.
• Decisive under pressure; records reasoning and holds to decisions.
• Develops senior engineers and shares knowledge down the tiers.
• Integrity: ethical and respectful to clients and team.
• Grit: self-motivates, self-manages, and meets deadlines when faced with competing priorities.
• Customer-centric: partnership with our clients is a win-win scenario.
• Selfless: when one team member succeeds, we all succeed.

Work Environment

• Onsite in Huntsville, Alabama, in an office setting within the 24/7 SOC.
• Weekday business hours, with scheduled on-call.
• Client-facing during and after incidents and on technical service matters.
• Occasional travel for client meetings and industry events.
• Must be a U.S. person; the SOC is staffed by U.S. personnel.
• Physical demands are representative of an office environment.

Why MAD Security

• Mission that matters: our clients build and support what the warfighter depends on, and the SOC is how we protect the systems that enable them.
• A real, in-person 24/7 SOC in Huntsville, Alabama, staffed by U.S. personnel working in the same room, at a time when most of the industry has gone fully remote.
• A company that holds itself to the standard it sells: MAD Security is CMMC Level 2 certified, an authorized C3PAO, and has been a Registered Provider Organization since the program began; our SOC platform runs on Elastic Cloud Gov, which is FedRAMP Moderate authorized.
• A modern platform direction: Elastic Security as the SIEM, detection as code, and agentic triage with human oversight, with the people on the floor shaping how AI is used rather than having it imposed on them.
• Direct access to leadership and real ownership. Standards you write get published and enforced; decisions you make get backed.
• A culture built on ten characteristics of every MAD Security professional, starting with customer service and satisfaction first and expertise as our specialty.

10 Characteristics of Every Professional at MAD Security

• Customer Service and Satisfaction First. Understanding and satisfying our customers is the cornerstone to our success.
• Expertise is our Specialty. Technical competence is essential to our service-oriented structure; we keep our knowledge current.
• Do and Deliver More Than Expected. Deliverables before they are due, of higher quality than anticipated, and under budget.
• Deliver on What We Say and What We Can Do. Before we say we can do something, we make sure we can.
• Communicate Effectively. Clearly, concisely, thoroughly, and accurately, whether verbal or written.
• Follow Exceptional Guiding Principles. High ethical values, good manners, honesty and fairness in all dealings.
• Praise Our Co-workers. Humble and generous in praise for others.
• Share Knowledge. Information is not a limited resource; we learn something new daily and pass it on.
• Express Gratitude. We thank others in a meaningful way.
• Maintain the Right Attitude. Pleasant even during trying times.

Other Duties It is not a comprehensive list of duties, responsibilities, and qualifications. MAD Security, LLC reserves the right to amend responsibilities to meet business and organizational needs, with or without notice. About MAD Security, LLC MAD Security, LLC, founded in 2010, is a veteran-owned cybersecurity provider headquartered in Huntsville, Alabama, and recognized as a Top 250 MSSP by MSSP Alert, as well as an Inc. Best Places to Work. We deliver managed security, governance, risk and compliance, and CMMC services to the Defense Industrial Base and other regulated industries, including aviation and aerospace, government contractors, financial institutions, technology service providers, higher education, and manufacturing. Our tagline says it plainly: we defend those that defend the mission.