SOC Lead

Reports To

Staff, Security Operations

What You Will Be Doing

As the SOC Lead, you will be a critical defender of ChargePoint’s global infrastructure, acting as the primary escalation point for advanced security incidents. Operating as a high-level individual contributor, you will lead incident response efforts, drive proactive threat hunting, and mature our detection engineering capabilities. You will play a vital role in protecting ChargePoint against advanced threats while mentoring a team of SOC analysts, optimizing our automated playbooks, and collaborating with cross-functional stakeholders and external MDR partners to ensure a robust security posture.

What You Will Bring to ChargePoint

• Manage and coordinate incident response from detection through containment, eradication, and post-incident review. Own P1/P2 escalations, drive root cause analysis, and ensure timely stakeholder communication.
• Design and execute proactive threat hunting campaigns using endpoint, network, and cloud telemetry. Consume and operationalize threat intelligence (MITRE ATT&CK, OSINT, vendor feeds) to stay ahead of adversary TTPs.
• Own the SIEM content lifecycle: build, tune, and maintain detection rules, correlation logic, and dashboards. Reduce alert fatigue through continuous tuning and signal-to-noise improvement.
• Develop and automate SOC playbooks and runbooks using SOAR capabilities. Drive measurable improvements in mean time to detect (MTTD) and mean time to respond (MTTR).
• Oversee data exfiltration monitoring across USB, cloud uploads, email, and AI tools. Lead weekly review cycles and coordinate with PeopleOps/ER on escalation cases.
• Mentor and develop SOC analysts. Conduct regular skill-building sessions, tabletop exercises, and purple team engagements. Foster a culture of curiosity, ownership, and continuous improvement.
• Manage the relationship with MDR providers and security tool vendors. Validate escalations, provide feedback on detection quality, and drive SLA accountability.

Requirements

• 6+ years of experience in a SOC, Incident Response, or Threat Hunting role, with at least 2 years in a lead or senior analyst capacity.
• Deep hands-on experience with EDR, SIEM/SOAR platforms, DLP tools, and cloud security.
• Strong understanding of the MITRE ATT&CK framework, kill chain methodology, and adversary emulation techniques.
• Experience investigating nation-state threats, business email compromise, insider threats, and supply chain attacks.
• Proficiency in scripting/automation (Python, PowerShell, KQL, or similar) for detection engineering and workflow automation.
• Excellent communication skills for cross-functional coordination with Legal, PeopleOps, and IT stakeholders.
• Bachelor's degree or equivalent experience.
• Certifications: Relevant certifications preferred, such as GCIH, GCFA, GCIA, OSCP, CySA+, or equivalent hands-on certifications.

Location

Gurgaon/Remote