SOC Team Lead (08:00–17:00 UTC)

As a SOC Team Lead at Tether, you lead the day-to-day operations of a global follow-the-sun Security Operations Center, covering the 08:00-17:00 UTC shift. You manage a distributed team of SOC Analysts across multiple regions and time zones, ensuring security events are monitored, investigated, and responded to effectively around the clock. You combine hands-on SOC expertise with proven leadership, setting operational standards, owning the incident response process, and continuously improving detection and response capabilities.

What you'll do

• Lead, coach, and develop a distributed team of SOC Analysts working across multiple regions in a follow-the-sun model
• Own the SOC schedule and shift rotations, including weekend coverage, ensuring continuous coverage across all time zones
• Define and enforce the shift handover process so that open investigations, ongoing incidents, and pending actions continue seamlessly around the clock
• Act as the primary escalation point for the team and as incident lead for major security incidents, coordinating triage, analysis, containment, eradication, recovery, and post-incident reviews with relevant teams
• Perform hands-on triage, investigation, and threat hunting alongside the team across the security stack, including SIEM, Endpoint Detection and Response (EDR), Security Service Edge (SSE), and Web Application Firewall (WAF) platforms
• Review the quality of investigations and incident documentation, providing structured feedback and ensuring consistent standards across shifts and regions
• Define, track, and report SOC metrics and KPIs, such as alert volumes, mean time to detect, mean time to respond, and false positive rates
• Drive the improvement of detection content together with security engineering, prioritizing the tuning of SIEM correlation rules, EDR custom detections, and WAF rules, and mapping coverage to frameworks such as MITRE ATT&CK
• Develop and maintain technical documentation, standard operating procedures, incident response playbooks, and escalation matrices
• Contribute to the hiring, onboarding, and training of new SOC Analysts
• Collaborate with IT, infrastructure, application, and security engineering teams, as well as management, to resolve incidents and support day-to-day operations
• Support vulnerability management and drive continuous improvement of the organization's overall security posture

What you bring

• A Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience
• At least 5 years of hands-on experience in Security Operations, including at least 1 year as a SOC Lead or in an equivalent team lead role
• Proven experience triaging alerts, investigating security incidents, and leading the response to major incidents in a production environment
• Solid working knowledge of core security technologies such as EDR, SSE, SIEM, and WAF, and of how to use them to investigate and respond to threats
• Experience leading or working in a 24/7 or follow-the-sun SOC, including managing shift schedules and remote teams across time zones
• Strong experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework
• An excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles
• Strong leadership, analytical, troubleshooting, and problem-solving skills with a high attention to detail
• The ability to handle sensitive information responsibly and securely
• Excellent written and verbal communication skills in English, including the ability to report to management and communicate clearly with technical and non-technical stakeholders during incidents

Nice to have

• Hands-on experience implementing, configuring, and tuning core security platforms, or writing and tuning detection content
• Relevant certifications such as Security+, CySA+, GCIA, GCIH, GSOM, CISSP, or vendor-specific credentials

About Tether

Tether is a global fintech leader that has pioneered reserve-backed stablecoins and digital asset tokenization. The company operates Tether Finance (featuring USDT, the world's most trusted stablecoin), Tether Power (sustainable Bitcoin mining with eco-friendly practices), Tether Data (peer-to-peer infrastructure and apps like KEET), Tether Education (digital learning for the gig economy), and Tether Evolution (emerging technologies). Tether's distributed team works remotely across every region of the world.