SecOps Team Leader

POSITION SUMMARY We are looking for a hands-on SecOps Team Lead to run our Security Operations team in Bangalore. This is a genuinely hybrid role: you will lead, coach and performance-manage a small team of Security Engineers/Analysts, while remaining hands-on in the tooling and actively working shifts alongside them. You will set the standard for technical quality, incident handling and SLA performance, act as the senior escalation point and incident commander for major security incidents and work a 24/7 shift rotation and on-call rota in the same way as the rest of the team. You will report to the Regional Head of Security Operations and be accountable for the day-to-day management, development and performance of the Bangalore team. This role is fully embedded in the 24/7 SecOps shift pattern: the Team Lead works shifts alongside the team and closely with the CIOPS patching team lead who works from the same office, including a mix of days, nights, weekends and public holidays on a rota basis, and also participates in the on-call rota as the senior escalation point for major incidents. The role reports to the Regional Head of Security Operations, with day-to-day accountability for the performance, wellbeing and development of the Bangalore SecOps team. What We Offer Fully sponsored professional certifications, including CISSP renewal, Microsoft, ISC2 and CompTIA credentials. A structured, well-defined career development pathway toward senior management and security architecture roles. The opportunity to lead a specialist team and build deep expertise in upper-quadrant enterprise security tooling used by a UK/US based global firm. Exposure to a genuinely global client base and senior stakeholders across the business. A supportive environment that invests in continuous learning and long-term career growth. EDUCATION AND EXPERIENCE Required Qualifications CISSP (Certified Info r mation Systems Security Professional) – required. A bachelor's degree in IT Security, Computer Science, Cyber Security or a closely related discipline. CompTIA Security+ or ISC2 Certified in Cybersecurity (CC). Written and spoken English, including report writing, to a minimum of IELTS 6.0 or equivalent. Demonstrable experience managing or leading a small technical security team to a high standard, with a track record of achieving excellent SLA and KPI performance. Demonstrable experience leading security incident response, including acting as incident commander or senior escalation point on major incidents. Willingness and ability to work within a 24/7 shift pattern and participate in the on-call rota, alongside the rest of the team. Preferred Certifications Preference will be given to candidates who currently hold one or more of the following Microsoft Associate-level certifications: SC-200 – Microsoft Certified: Security Operations Analyst Associate SC-300 – Microsoft Certified: Identity and Access Administrator Associate SC-401 – Microsoft Certified: Information Security Administrator Associate SC-500 – Microsoft Certified: Cloud and AI Security Engineer Associate SC-100 – Microsoft Certified Security Architect Expert Desirable Experience and Skills 5+ years' experience in a technical security role, including recent hands-on experience of the Microsoft Security Stack, with at least 1-2 years in a team leadership or line management capacity. Practical administration or operational experience with Proofpoint (or equivalent email security platform). Experience operating DNS filtering / secure web gateway tooling (e.g. Cisco Umbrella, Zscaler, or similar). Experience managing security queues and SLAs within an ITSM or ticketing platform (e.g. ServiceNow, Jira Service Management). Experience of network and application firewalls. Working knowledge of technical security frameworks such as ISO 27001, NIST, SOC 2 and Cyber Essentials Plus. Experience with Privileged Access Management (PAM) tools such as CyberArk, Entra or SailPoint. Experience building or maturing incident response processes, runbooks and playbooks. Additional Microsoft or wider security certifications are an advantage. Active membership and engagement with a local chapter of ISC2, ISACA or a similar professional security body. Strong coaching and people-development skills, with a genuine interest in growing junior team members' careers. KEY JOB ELEMENTS Lead, manage and develop a small team of Security Engineers/Analysts in Bangalore, setting clear standards of technical quality and holding the team to them. Own the team's SLA and KPI performance, monitoring queues, response and resolution times, and driving continuous improvement to consistently deliver excellent SLAs. Remain hands-on: personally work alerts, investigations and tooling alongside the team rather than managing at a distance. Act as incident commander for major and escalated security incidents, leading the response end to end and coordinating internal teams, the wider SOC provider and client-facing teams through triage, containment, eradication, recovery and post-incident review. Build and embed the team's incident response process, playbooks and escalation paths, and lead post-incident reviews to drive lessons learned. Manage the team shift rota while actively working within the 24/7 shift pattern and on-call rota, providing senior out-of-hours escalation cover. Oversee administration and operation of email security tooling, including Targeted Attack Protection (TAP), Email Protection, Threat Response Auto-Pull (TRAP) and browser isolation. Oversee operation and administration of the Microsoft E5 security stack, including Microsoft Sentinel, Microsoft Defender XDR, Microsoft Purview and Microsoft Entra ID. Oversee DNS filtering and web security controls, ensuring policies are effectively tuned to reduce the organisation's external attack surface. Ensure disciplined use of the ticketing/ITSM system across the team, with accurate documentation, timely updates and consistent SLA adherence. Coach, mentor and support the professional development of team members, including certification progress and career pathway planning. Own vulnerability management prioritisation and drive patching workloads against internal security standards and relevant local regulatory or legal requirements. Contribute to security policy, GRC, compliance, technical security control audits and management/KPI reporting. Support and drive the organisation's progress toward Zero Trust across all areas of the business. Act as a key point of contact for client-facing teams and the wider SOC provider on team performance and escalations. PERSON SPECIFICATION High levels of personal integrity and professionalism. Resilient, calm and decisive under pressure. Strong sense of accountability and ownership. Demonstrable leadership presence and credibility. Passion for mentoring and developing others. Highly organised with excellent attention to detail. Collaborative and relationship-focused. Customer-centric with strong commercial awareness. Adaptable and comfortable operating within a 24/7 environment. Positive, proactive and solutions-oriented mindset. We are an equal opportunity employer and value diversity in our workforce. All qualified applicants will receive consideration for employment without regard to race, colour, religion, gender, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law. We are committed to creating an inclusive environment where everyone can thrive.