Sigma Suisse, based in Plan-les-Ouates, is a recruitment firm specialised in IT and strategic profiles, supporting leading organisations across French-speaking Switzerland.
Within our IT department, we cover hiring needs in Commodity and Financial Trading, Pharmaceuticals, Aeronautics, Space, Energy, Watchmaking and Swiss foundations.
Our client is looking for a Security Operations Lead to build, run and continuously improve its internal Security Operations Centre.
Based in Geneva, with London also possible, you will combine hands-on cyber defence as a senior L2/L3 incident handler with leading a SOC team. You will report to the CISO.
Key responsibilities
- Lead and develop a distributed SOC team, with 24/7 follow-the-sun coverage and consistent service quality
- Define SOC procedures, escalation paths, shift handovers and KPIs (MTTD, MTTR, false-positive rate)
- Act as the main interface with the outsourced SOC provider, oversee its performance and drive improvements
- Own the detection engineering lifecycle in Microsoft Sentinel (KQL), with coverage mapped to MITRE ATT&CK
- Bring in threat intelligence feeds and lead proactive threat hunting
- Lead complex incident response from triage to recovery, working with IT, Legal and Compliance
- Run post-incident reviews and root-cause analysis, then turn the findings into new detections and process updates
- Write and test playbooks and runbooks (phishing, ransomware, BEC, insider threat, cloud compromise, data exfiltration)
- Run tabletop and purple-team exercises with the internal Red Team
- Report on SOC performance, threat landscape and risk posture to the CISO and senior stakeholders
Required experience
- 4+ years in cybersecurity operations, incident response or security engineering
- Proven experience leading a SOC team, including remote or distributed staff
- Solid understanding of SOC operating models (tiered, hybrid, follow-the-sun)
- Track record of building or significantly improving detection and response capabilities
- Cloud security on AWS (GuardDuty, CloudTrail, Security Hub) and Azure (Defender for Cloud, Entra ID Protection), plus Wiz
- Digital forensics, malware analysis, NIST CSF and NIST 800-61
- Strong communication skills, able to explain technical findings to executives
Nice to have
- Certifications: CISSP, CISM, GCIH, GCIA, GCED, SC-200, AZ-500
- Background in commodity trading, energy or financial services
- Experience with SOAR, Python and PowerShell scripting
#J-18808-Ljbffr
Security Operations Center Architect in Genf Arbeitgeber: Sigma Suisse
pSigma Suisse in Genf bietet eine dynamische Arbeitsumgebung, die auf Zusammenarbeit und Innovation setzt. Als Spezialist für GMP- und CSV-Validierung haben Sie die Möglichkeit, an spannenden Projekten mit einer renommierten Pharmafirma zu arbeiten, während Sie von einem unterstützenden Team profitieren, das Ihre berufliche Entwicklung fördert. Genießen Sie flexible Arbeitszeiten und ein positives Arbeitsklima, das Wert auf Ihre Ideen und Ihr Engagement legt.
