Embedded Cyber Detection and Response Deputy Team Lead

Overview

As Deputy Team Lead for the Cyber Detection and Response Team, you support the Team Lead in maturing and delivering the client’s detection and response capabilities. You bridge hands-on cyber operations with leadership, guiding threat detection, incident response, hunting, and detection engineering while supervising day-to-day operations. You act as escalation point during shifts and off-hours, ensuring continuous, high-quality service. You will influence security posture through collaboration with engineering and stakeholders, driving operational improvements and playbook governance.

Responsibilities

• Escalation point for analysts during assigned shifts and off-hours
• Lead investigations into high-severity incidents with containment, remediation, and reporting
• Oversee triage and investigation across endpoint, network, cloud, and identity environments
• Conduct advanced threat hunting to uncover new threats and gaps in detection
• Support incident response including digital forensics, root cause, and post-incident reviews
• Collaborate with Security Engineering to improve detection logic and automation
• Act as Team Lead during absences or out-of-hours coverage
• Review investigation quality and reporting standards for consistency
• Contribute to performance feedback and professional development
• Assist in implementing new detection initiatives, technologies, and operational improvements
• Help establish and refine SOPs, playbooks, escalation frameworks, and response processes
• Participate in planning with Security Engineering and client stakeholders to improve security posture
• Identify opportunities to boost team effectiveness via automation and workflow optimization
• Maintain strong relationships with client security, technology, and business stakeholders
• Provide operational updates and incident briefings to internal and client stakeholders
• Ensure clear communication and documentation throughout investigations and response activities

Key requirements

• 7+ years in cybersecurity with strong incident response, SOC operations, threat hunting, or cyber defense experience
• Experience mentoring analysts and leading investigations or acting as a technical lead
• Hands-on experience with SIEM, EDR/XDR, SOAR, IDS/IPS, log management, and cloud security technologies
• Experience with Splunk, Microsoft Sentinel, CrowdStrike, SentinelOne, Palo Alto, Microsoft Defender, or equivalent platforms
• Solid understanding of incident response methodologies, forensics, malware analysis, and threat hunting
• Knowledge of MITRE ATT&CK, NIST CSF, and incident response best practices
• Experience supporting operational improvement initiatives, tool implementations, or maturity efforts
• Strong analytical and problem-solving skills; ability to communicate technical concepts to both technical and non-technical audiences
• Experience in a 24/7 operational environment and on-call or escalation rotations
• Preferred certifications: CISSP, GCIH, GCIA, GCFA, GSOM, CISM or equivalent

• Strategic leadership
• Clear communication across technical and non-technical audiences
• Collaboration and teamwork
• SIEM
• EDR/XDR
• SOAR

Full job description from WhatJobs. Apply for this role →