SOC Director

About GoSecure

Role Summary

SOC Operations and Improvement

• Lead security monitoring, detection, investigation, incident response, escalation, and coordination.
• Collaborate with engineering to integrate internally developed technologies into SOC workflows and service delivery.
• Drive process improvement to increase analyst productivity and reduce repetitive manual tasks.
• Implement AI, automation, SOAR, and agentic technologies for triage, enrichment, investigation, threat hunting, detection engineering, response, and reporting.
• Develop an automation strategy based on impact, risk, scalability, and return on investment.
• Monitor operational metrics including alert volumes, analyst workload, automation rates, response times, false positives, MTTD, and MTTR.
• Lead root-cause analysis and corrective actions for recurring or significant operational issues.
• Coordinate major security incident response across departments and stakeholders.

Client and Commercial Support

• Act as a senior client contact for SOC performance, escalations, security incidents, operational challenges, and improvement initiatives.
• Build client relationships and align SOC services with client security objectives.
• Participate in client governance, service reviews, executive discussions, and other client-facing activities.
• Support sales, account management, and customer success teams in prospect meetings, technical presentations, solution discussions, and RFP/RFI responses.
• Translate technical SOC capabilities into business value for technical and executive audiences.
• Provide technical consulting on networks, security controls, detection and response capabilities, and SOC best practices.

Qualifications and Experience

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.
• French and English bilingualism is mandatory.
• Microsoft Expert status is mandatory.
• Experience as a technical lead, SOC leader, or people manager in a security operations environment.
• Strong understanding of SOC operating models, processes, workflows, performance management, and operational efficiency improvement.
• Experience with client management, escalations, service issues, and client relationships.
• Experience with problem management, root-cause analysis, and continuous improvement methodologies.
• Experience supporting sales or pre-sales activities.

Technical Skills

• Hands-on experience with SOAR platforms, APIs, scripting, workflow automation, or equivalent technologies.
• Practical understanding of AI and generative AI in cybersecurity operations.
• Experience designing automated workflows for alert enrichment, triage, investigation, incident response, threat intelligence, detection engineering, or reporting.
• In-depth experience with SIEM and security analytics platforms such as Microsoft Sentinel, Splunk, Google SecOps, QRadar, or equivalent.
• Experience with MITRE ATT&CK and CIS Critical Security Controls.
• Strong background in incident handling, threat intelligence, detection engineering, and threat hunting.
• Experience with EDR/XDR, NDR, IDS/IPS, firewalls, DLP, email security, web proxies, identity security, and cloud security platforms.
• Understanding of IP, DNS, HTTP/S, SMTP, and OSI model concepts.

Benefits

• Benefits include vacation, personal days, paid holidays, group insurance, an employee assistance program, RRSP matching, recognition programs, stock options, and merchant discounts.