Security Operations Lead

Vitol is a global energy and commodities company, specializing in the trading and distribution of energy products. With a revenue of $331 billion in 2024, Vitol handles over seven million barrels of crude oil and products daily, using 250 ships for transportation. The company serves a diverse client base, including national oil companies, multinationals, and leading industrial companies, from 40 offices worldwide. Vitol is also committed to renewable energy, having invested over $2.5 billion in renewable projects and identifying low-carbon opportunities globally. The Security Operations Lead will oversee the Security Operations Centre (SOC), ensuring 24/7 coverage and consistent service quality across three global offices: Singapore, London, and Houston. This role involves leading a team of four SOC analysts/engineers, defining and enforcing operating procedures, and managing the external SOC relationship. The lead will also report on SOC performance, threat landscape trends, and risk posture to the CISO and senior stakeholders. To excel in this role, candidates must have at least four years of experience in cybersecurity operations, incident response, or security engineering. They should have a strong understanding of SOC operating models and a proven track record in building or improving detection and response capabilities. Technical expertise in Microsoft Sentinel (KQL), Microsoft Defender for Endpoint, and various cloud security tools is essential. Proficiency in incident response, including digital forensics and malware analysis, is also required. Familiarity with frameworks like MITRE ATT&CK and NIST CSF is crucial. Nice-to-have skills include industry certifications such as CISSP, CISM, or GCIH, and experience in the commodity trading, energy, or financial services sector. Familiarity with automation and orchestration platforms, scripting languages, and threat hunting methodologies is advantageous. French language skills are beneficial for candidates based in Geneva. The role involves periodic travel between Geneva and London, with occasional trips to Singapore and Houston. The team is distributed across three global offices, and the role offers opportunities for professional growth and continuous improvement. The company fosters a culture of collaboration and innovation, with a focus on enhancing detection and response capabilities. What the role asks for: - 4+ Jahre Erfahrung in Cybersecurity Operations, Incident Response, oder Security Engineering. - Experience in leading or managing a SOC team, including remote/distributed personnel. - Strong knowledge in SOC operational models (tiered, hybrid, follow-the-sun). - Proven success in improving detection and response capabilities. - Technical expertise in Microsoft Sentinel (KQL), Microsoft Defender for Endpoint, AWS, Microsoft Azure, Wiz, Microsoft Purview, Varonis, Zscaler, Palo Alto Networks. - Knowledge in digital forensics, malware analysis, and chains of custody. - Knowledge in MITRE ATT&CK, NIST CSF, NIST 800-61 (Incident Handling).