SOC Analyst- Shift Lead (R-00124)

{
  "content_hash": "6cc8e37c7bbd89e8e114ff45d7ced97d35bb7cf3bfd6669c3dc14c082ed91b64",
  "source_hash": "73e73de53fe8a41d38a59ce82235d3fba6f7551e0f473a31830ea64daa5532e7",
  "last_changed_at": "2026-05-29T07:10:49.241Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "Topeka, KS",
    "city": "Topeka",
    "region": "KS",
    "country": "United States",
    "is_remote": false,
    "confidence": 0.9
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T07:57:40.711Z",
  "launch_scope": {
    "reason": "english_us_canada",
    "included": true,
    "language": "en",
    "location": {
      "raw": "Topeka, KS",
      "city": "Topeka",
      "region": "KS",
      "country": "United States",
      "is_remote": false,
      "confidence": 0.9
    },
    "countries": [
      "United States"
    ]
  },
  "remote_policy": null,
  "salary_period": null,
  "workplace_type": "on_site",
  "salary_currency": null
}

{}

{
  "lists": [
    {
      "text": "Job Responsibilities ",
      "content": "\n<li>Supervise and mentor SOC Analysts</li>\n<li>Assign and balance workload across analysts and shifts</li>\n<li>Monitor queue health, SLA compliance, and alert backlog</li>\n<li>Conduct regular performance check-ins</li>\n<li>Address quality gaps and provide corrective guidance</li>\n<li>Reinforce adherence to documented playbooks and procedures</li>\n<li>Primary Focus: Ensure consistent and effective analyst performance.</li>\n<li>Hands-On Monitoring &amp; Investigation</li>\n<li>Perform daily alert triage alongside SOC Analysts</li>\n<li>Conduct investigations on moderate to high-severity alerts</li>\n<li>Lead or directly support complex or multi-system investigations</li>\n<li>Validate alert classifications and case documentation</li>\n<li>Participate in shift coverage as needed</li>\n<li>Primary Focus: Maintain technical engagement and operational credibility.</li>\n<li>Serve as the first escalation point for analysts</li>\n<li>Lead investigations for high-severity incidents</li>\n<li>Coordinate response actions with internal stakeholders</li>\n<li>Ensure timely and accurate communication during incidents</li>\n<li>Drive investigations to clear, defensible conclusions</li>\n<li>Primary Focus: Maintain operational control during critical events.</li>\n<li>Investigation Quality &amp; Case Governance</li>\n<li>Review analyst investigations for accuracy and completeness</li>\n<li>Approve or return cases prior to closure</li>\n<li>Ensure proper evidence collection and timeline documentation</li>\n<li>Enforce consistent tagging, classification, and case hygiene</li>\n<li>Primary Focus: Protect the integrity of SOC output.</li>\n<li>Process &amp; Continuous Improvement</li>\n<li>Maintain and update SOC playbooks and workflows</li>\n<li>Identify inefficiencies in monitoring or case handling</li>\n<li>Provide feedback on alert tuning and automation improvements</li>\n<li>Capture and integrate lessons learned</li>\n<li>Stakeholder Coordination</li>\n<li>Respond to formal information requests within defined SLAs</li>\n<li>Serve as liaison between SOC analysts and leadership</li>\n<li>Support audits, reporting, and compliance requirements</li>\n<li>Participate in shift handoffs and operational planning</li>\n<li>Primary Focus: Maintain trust and communication across teams.</li>\n<li>Workload Segmentation (Approximate)</li>\n<li>30% – Direct Monitoring &amp; Investigation Work</li>\n<li>25% – Escalation &amp; High-Severity Incident Leadership</li>\n<li>20% – Team Management &amp; Performance Oversight</li>\n<li>15% – Investigation Quality Review &amp; Case Governance</li>\n<li>10% – Process Improvement &amp; Documentation</li>\n<li>Percentages may shift during major incidents or staffing changes.</li>\n"
    },
    {
      "text": "Job Qualifications  ",
      "content": "\n<li>Onsite is required</li>\n<li>Prior experience as a SOC Analyst or Senior Analyst</li>\n<li>Demonstrated ability to lead or coordinate investigations</li>\n<li>Experience mentoring or supervising analysts</li>\n<li>Strong knowledge of: SIEM platforms (Splunk or equivalent) EDR tools, Network, authentication, and endpoint telemetry</li>\n<li>Strong documentation and communication skills</li>\n<li>Ability to make sound decisions in time-sensitive situations</li>\n<li>CompTIA Security+ or CySA+ (or equivalent)</li>\n<li>Experience in incident response or threat hunting</li>\n<li>Familiarity with NIST, CIS, CJIS, or similar frameworks</li>\n<li>Experience with case management multiple platforms</li>\n<li>Scripting/query experience (SPL, KQL, SQL, Python)</li>\n<li>Experience in regulated or government environments</li>\n<li>GCIH, GCIA, GCED or equivalent</li>\n<li>Core Competencies include: Technical leadership, operational accountability, coaching and mentorship, analytical problem-solving, process discipline, clear written and verbal communication, ability to lead under pressure</li>\n<li><strong>Role Notes:</strong></li>\n<li>This is both a management and technical role.</li>\n<li>The Team Lead is expected to maintain hands-on investigative capability.</li>\n<li>Operational response takes priority during active incidents.</li>\n<li>Decisions made in accordance with approved documentation are supported.</li>\n<li>The Team Lead is accountable for team output, not just individual cases.</li>\n<li>This role serves as the primary contact point with state wide cybersecurity collaboration.</li>\n<li>Managing weekend coverage may be necessary.</li>\n"
    }
  ],
  "country": "US",
  "createdAt": 1771425669862,
  "updatedAt": null,
  "categories": {
    "team": "Security Analyst Team",
    "location": "Topeka, KS",
    "commitment": "Full-Time",
    "department": "Security Resilience",
    "allLocations": [
      "Topeka, KS",
      "Kansas, USA"
    ]
  },
  "salaryRange": null,
  "workplaceType": "onsite"
}