MDR Team Lead

Up to 12 years of total work experience.

5+ years of experience in cybersecurity, with a minimum of 2-3 years of experience leading, mentoring, or coordinating analysts in a SOC, MDR, Incident Response, or similar environment.

Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent practical experience.

Hands-on experience in security operations, including threat detection, incident investigation, and response.

Strong understanding of endpoint and network security technologies, including IDS/IPS, EDR, ATP, malware protection, and monitoring platforms.

Experience with threat hunting methodologies and familiarity with the MITRE ATT&CK framework preferred.

Working knowledge of incident response processes, adversary tactics and techniques, and cyber threat intelligence.

Strong technical expertise in Windows environments, including host artefacts, endpoint telemetry, event log analysis, and operating system security events; exposure to macOS and Linux is a plus.

Solid understanding of network fundamentals, including TCP/IP, routing, switching, and traffic analysis.

Experience with SIEM platforms and enterprise security data management; database querying skills are advantageous.

Working knowledge of PowerShell and Python for automation and investigation support.

Strong analytical, troubleshooting, and decision-making skills, with the ability to prioritise effectively in high-pressure situations.

Excellent written and verbal communication skills, including the ability to produce clear reports, case summaries, operational updates, and executive-ready communications.

Experience performing quality reviews and providing actionable feedback that improves investigation outcomes and analyst performance.

Proven ability to build team capability through coaching, onboarding, training, and knowledge sharing.

Strong stakeholder management and customer-facing skills, with the capability to explain technical findings, risks, and recommendations to both technical and non-technical audiences.

Advanced cybersecurity certifications are preferred but not required.