Use Case Management Team Lead

SOC Manager I

 

Who We Are:

Born digital, UST transforms lives through the power of technology. We walk alongside our clients and partners, embedding innovation and agility into everything they do. We help them create transformative experiences and human-centered solutions for a better world.

UST is a mission-driven group of 29,000+ practical problem solvers and creative thinkers in more than 30 countries. Our entrepreneurial teams are empowered to innovate, act nimbly, and create a lasting and sustainable impact for our clients, their customers, and the communities in which we live.

With us, you’ll create a boundless impact that transforms your career—and the lives of people across the world.

Visit us at UST.com.

 

 

You Are:

We are looking for an experienced Use Case Management Team Lead to drive the development, optimization, and deployment of detection use cases across multiple SIEM platforms. This role will combine technical expertise, leadership, and customer-facing skills to manage a global team of detection engineers while providing expert cybersecurity guidance and consultation to enterprise customers. As a key member of our Security Operations Team, you will ensure that our service offerings remain at the forefront of threat detection, automation, and response capabilities, supporting our diverse client base worldwide. Your work, guidance and expertise will have a dominant effect on the whole organization.

 

The Opportunity:

·       Manage and mentor a global team of detection engineers responsible for building, tuning, and optimizing detection use cases across a range of SIEM platforms.

·       Consult our customer and deploy best practices among the UCM team, and MDR.

·       Oversee the team’s daily operations and ensure high-quality deliverables for customers, balancing customer requirements, team capacity, and timelines.

·       Continuously develop and enhance the UCM service and its deliverables.

·       Provide technical leadership in SIEM use case development, incident detection, and automation best practices to ensure high efficacy across a variety of enterprise environments.

·       Engage directly with enterprise customers worldwide to understand their security requirements and translate them into actionable use cases and security content strategies.

·       Provide expert advice and guidance on SIEM tool configuration, detection rule development, and incident response workflows tailored to each client’s unique threat landscape.

·       Lead the development and deployment of custom detection use cases across multiple SIEM platforms, including Google Chronicle, Azure Sentinel, Splunk, QRadar, and others.

·       Continuously enhance detection capabilities by analyzing attack techniques (e.g., MITRE ATT&CK), incorporating emerging threats, and reducing false positives.

·       Establish and enforce best practices for writing KQL (for Azure Sentinel), SPL (for Splunk), or equivalent query languages for other SIEMs.

·       Lead customer workshops, training sessions, and regular reviews to assess the effectiveness of current detection rules and offer recommendations for continuous improvement.

·       Ensure all use cases and playbooks are well-documented, including detailed descriptions, workflow diagrams, and relevant technical configurations.

·       Keep up-to-date with the latest security threats, attack vectors, and techniques (e.g., MITRE ATT&CK) to ensure use cases are effective and relevant.

 

This position description identifies the responsibilities and tasks typically associated with the performance of the position. Other relevant essential functions may be required.

 

What You Need:

·       10+ years of experience in cybersecurity, with at least 5 years of hands-on experience in SIEM technologies such as Azure Sentinel, Google SecOps, Splunk, and QRadar as well as detection engineering.

·       3+ years of experience in a leadership or team lead role, managing or mentoring detection engineers.

·       Experience supporting enterprise customers globally, with a strong understanding of the challenges and needs of large, complex environments.

·       Expertise in designing, building, and tuning detection use cases across multiple SIEM platforms (Azure Sentinel, Splunk, QRadar, etc.).

·       Proficiency in detection query languages (KQL, SPL, etc.) and knowledge of common detection techniques (MITRE ATT&CK).

·       Preferred SIEM vendor certification of administrator.

·       Familiarity with different security attack vectors and means of protection.

·       Familiarity with security monitoring, incident detection, and incident response best practices.

·       Strong communication and presentation skills, with the ability to explain complex technical concepts to non-technical stakeholders.

·       Proven leadership abilities, with experience managing remote or global teams.

·       Ability to work under pressure and balance multiple priorities while maintaining a focus on customer satisfaction.

·       Strong problem-solving skills and attention to detail, with a proactive, customer-centric approach.

·       University degree in information security or equivalent work experience.

·       Relevant certification (e.g., GIAC GSOC, CSA, CISSP) is an advantage.

 

 

Compensation can differ depending on factors including but not limited to the specific office location, role, skill set, education, and level of experience. UST provides a reasonable range of compensation for roles that may be hired in various U.S. markets as set forth below.

Role Location: Remote

Compensation Range: $82,000-$123,000      

 

 

Benefits

Full-time, regular employees accrue a minimum of 10 days of paid vacation per year, receive 6 days of paid sick leave each year (pro-rated for new hires throughout the year), 10 paid holidays, and are eligible for paid bereavement leave and jury duty. They are eligible to participate in the Company’s 401(k) Retirement Plan with employer matching. They and their dependents residing in the US are eligible for medical, dental, and vision insurance, as well as the following Company-paid Employee Only benefits: basic life insurance, accidental death and disability insurance, and short- and long-term disability benefits. Regular employees may purchase additional voluntary short-term disability benefits, and participate in a Health Savings Account (HSA) as well as a Flexible Spending Account (FSA) for healthcare, dependent child care, and/or commuting expenses as allowable under IRS guidelines. Benefits offerings vary in Puerto Rico.

Part-time employees receive 6 days of paid sick leave each year (pro-rated for new hires throughout the year) and are eligible to participate in the Company’s 401(k) Retirement Plan with employer matching.

Full-time temporary employees receive 6 days of paid sick leave each year (pro-rated for new hires throughout the year) and are eligible to participate in the Company’s 401(k) program with employer matching. They and their dependents residing in the US are eligible for medical, dental, and vision insurance.

Part-time temporary employees receive 6 days of paid sick leave each year (pro-rated for new hires throughout the year).

All US employees who work in a state or locality with more generous paid sick leave benefits than specified here will receive the benefit of those sick leave laws.

 

What We Believe:

We proudly embrace the values that have shaped UST since day one. We build our culture of Humility, Humanity, and Integrity. These values inspire us to nurture a people-first, human centric culture that fosters diversity, prioritizes sustainable solutions, and keeps our people and clients at the forefront of all decisions.

Humility:

We will listen, learn, be empathetic and help selflessly in our interactions with everyone.

Humanity:

Through business, we will better the lives of those less fortunate than ourselves.

Integrity:

We honor our commitments and act with responsibility in all our relationships.

 

Equal Employment Opportunity Statement

UST is an Equal Opportunity Employer.

 

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other applicable characteristics protected by law. We will consider qualified applicants with arrest or conviction records in accordance with state and local laws and “fair chance” ordinances.

UST reserves the right to periodically redefine your roles and responsibilities based on the requirements of the organization and/or your performance.

 

 

#UST

#CB

#LI-IS1

#LI-Remote