SOC Technical Lead - Threat Hunting & Incident Response
Thales · Madrid, Spain ·
COMPENSATION
€•• – ••k
Listed on WeAreDevelopers
- Hybrid work (Madrid)
- SOC Technical Lead
- Threat Hunting focus
- Cloud security (AWS/Azure)
- Up to 41 days off
Join the central services team at Thales S21sec Spain to drive proactive defense strategies and lead incident response efforts. You will mentor analysts, refine security playbooks, and integrate security automation into cloud infrastructure.
This position requires deep expertise in SIEM, EDR, and network analysis within distributed environments. You will partner with product teams to implement Security-as-Code and protect global digital interactions.
What you'll do
- Spearhead threat hunting strategy using advanced telemetry and intelligence
- Lead technical incident response and conduct deep-dive forensics
- Mentor team members through workshops and hands-on guidance
- Partner with cloud teams to integrate security into development lifecycles
- Refine defense playbooks to counter sophisticated attacker patterns
What you'll need
- At least 2-5 years in cybersecurity operations or incident response
- Experience in a technical lead or senior advisory capacity
- Strong background in high-scale cloud or hybrid environments
- Advanced knowledge of MITRE ATT&CK framework and attacker TTPs
- Deep expertise in SIEM/SOAR, EDR/XDR, and network traffic analysis
- Familiarity with forensic analysis tools and procedures
Stack
- AWS
- Azure
- GCP
- SIEM
- SOAR
- EDR
- XDR
- MITRE ATT&CK
How you'll work
- Location: Madrid, Emilio Vargas, Spain
- 100% flexible hybrid work model
- Option to work from home or office as chosen
What you get
- Up to 41 days off per year including flexible days
- One free Friday per month option
- Flexible compensation with meal and transport vouchers
- Annual training plan for certifications and languages
- Performance-based annual bonuses linked to KPIs
- Career paths in leadership or technical specialization