SOC Team Leader – Security Operations

About the role

Join Check Point’s Security Operations Center as a Team Leader, guiding a group of analysts who protect thousands of organizations from advanced cyber and AI‑driven threats. You will own high‑severity incidents from detection through resolution and help shape the future of automated security response.

Key responsibilities

• Lead, mentor, and develop a team of SOC analysts, managing day‑to‑day performance.
• Own complex, high‑severity incidents, overseeing detection, containment, resolution, and post‑incident lessons.
• Manage shift coverage and scheduling to ensure 24/7 security operations.
• Design, approve, and continuously improve SOAR playbooks and automation flows.
• Propose and implement automation to accelerate investigations and reduce repetitive work.
• Enhance detections, investigation workflows, and runbooks, measuring the impact of changes.
• Develop AI‑driven and agent‑based capabilities for detection, investigation, and response.
• Define SOC KPIs, report performance, incident trends, and risk insights to management.
• Collaborate with engineering, IT, threat intelligence, and other teams during investigations and improvement initiatives.
• Hire, onboard, and train new analysts.
• Maintain clear, professional, service‑oriented communication with internal stakeholders.

Required profile

• 4+ years of experience in a SOC or comparable cybersecurity role, including hands‑on handling of high‑severity incidents.
• Proven experience leading or mentoring security analysts.
• Strong analytical thinking and steady judgment under pressure.
• Excellent written and verbal communication skills in English.

Required skills

• SOAR playbook design and security automation.
• SIEM, EDR, XDR platforms.
• External Attack Surface Management (EASM) and Cloud Detection & Response (CDR) tools.
• AI and agent‑based security solutions.
• MITRE ATT&CK framework and threat modeling.
• Deep knowledge of common cyber threats (phishing, malware, ransomware, credential theft, supply‑chain attacks).
• Understanding of IT infrastructure, operating systems, cloud environments, and networking fundamentals.