SOC Operations Deputy Lead

Northwave is a leading European cybersecurity specialist, protecting organizations against increasingly complex digital threats. With deep expertise in offensive and defensive security, behavior, and monitoring, we support our customers through managed security services and high-impact consultancy. Our Security Operations Center plays a central role in this mission, operating as a high-trust, high-precision environment where technology and expertise come together.

To further strengthen this foundation, we are expanding our Operations capability within the SOC team.

The Role:

The SOC Operations Deputy Lead supports the Team Lead in managing the SOC analysts and ensuring smooth day-to-day operations. This role focuses on operational leadership, mentoring, and quality assurance, acting as a bridge between analysts and leadership, especially during the Team Lead’s absence.

Key Responsibilities:

· Assist in coordinating daily SOC-OPS activities and shift operations.

· Provide technical guidance and mentoring to analysts.

· Ownership of operational standards; collaborate with the Team Lead on reporting and metrics in Creating Dashboards and KPI’s for SOC Performance.

· Act as escalation point for operational issues and incidents.

· Work with the team to Focus on optimizing alerting to reduce false positives.

· Lead incident response efforts when required and ensure proper documentation.

· Review escalated security incidents and guiding Tier 1 and Tier 2 analysts

· Support quality assurance and influence continuous improvement initiatives.

· Step in as acting Team Lead during absences or leave.
HR Responsibilities: None. The Deputy Lead does not hold formal HR responsibilities but may provide input on performance and development during reviews.

· Assist in shift planning, workload distribution, and operational coverage when needed or in the absence of the team lead.

· Attend Vendor meetings with the team lead to help support SOC Operations

· Support tier two analysts with customer related queries and support on Tickets

· Support OPS by regualrly taking queue work in investigation and triage to understand difficulties and bottlenecks of the team

· Contribute to Operational Improvement processes and documentation of such.

· Working within the team on dedicated threat hunts and recomending improvments.

Technology and Environment:

In addition to the core role, Your work will also require technical expertise in an environment where SOC Operations quality and operational reliability are essential:

· Understand log sources (Windows, Linux, network, cloud, EDR logs) and what “normal vs. abnormal” looks like.

· Understand Detection Rules, KQL Queries, scheduled analytics, and correlation rules.

· Have a strong hands on Incident Response experience, including Triage, containment, eradication and recovery procedures.

· Network Traffic Analysis

· Understand attacker TTPs: lateral movement, privilege escalation, command & control.

· Use of IR tooling (EDR, XDR, packet capture, forensics suites).

· Knowledge of common network protocols (DNS, HTTP/S, SMB, RDP) and how attackers pivot through networks

· Have an understanding of how vulnerabilities are scored, exposure management and prioritization, and how atackers weaponize vulnerabilities.

· Skilled in scripting with Python, Powershell, Bash, creating SOAR Playbooks (eg. In Sentinel, Swimlane)

· Technical awareness of Security Frameworks (NIST 800-61, ISO 27001, CIS Controls)