> Markdown version of [/jobs/ext/1732319-soc-lead-incident-responder-confidential](https://www.wearedevelopers.com/jobs/ext/1732319-soc-lead-incident-responder-confidential). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Lead Incident Responder - Confidential

- **Company:** Insight Global
- **Location:** Medford, OR, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Azure, BASIC (Programming Language), CompTIA Security+, Log Analysis, Microsoft Security Essentials, Azure Active Directory, Kusto Query Language, Security Information and Event Management, Mitre Att&ck, Microsoft Sentinel
- **Published:** July 19, 2026
- **Apply:** https://www.juju.com/job/00000000ghmnkt

## About the Role

* Hands-on experience with Microsoft Sentinel (Azure SIEM): alert triage, investigation, and basic KQL queries.

 * Proficiency with Microsoft Defender (EDR): endpoint investigation, alert analysis, and containment actions.

 * Working knowledge of Microsoft Entra ID: identity protection, sign-in log analysis, and conditional access concepts.

 * Solid understanding of incident response fundamentals (detection, triage, containment, eradication, recovery, lessons learned).

 * Familiarity with common attack techniques and frameworks (e.g., MITRE ATT&CK).

 * Strong analytical, communication, and documentation skills.

 * Ability to remain calm and lead under pressure during active incidents. * Relevant certifications such as SC-200, AZ-500, CompTIA Security+, or equivalent.

 * Prior experience in a SOC or incident response environment.

## Description

The SOC Lead Incident Responder (Tier 1) serves as the primary point of contact for security alerts and is responsible for triaging, investigating, and leading the response to cybersecurity incidents as part of the SOC team. This is a hands-on technical role focused on rapid detection and containment using the organization's Microsoft security stack. While not a people-management position, the responder takes the lead on coordinating incident response activities and guiding fellow analysts through the response process.


## Related Videos

- [Developer Tools for Microsoft Azure](https://www.wearedevelopers.com/videos/450-developer-tools-for-microsoft-azure)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes)
- [Develop enterprise-ready applications for Microsoft Teams with Azure resources on modern web technologies](https://www.wearedevelopers.com/videos/187-develop-enterprise-ready-applications-for-microsoft-teams-with-azure-resources-on-modern-web-technologies)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Leveraging Large Language Models for Legacy Code Translation: Challenges and Solutions](https://www.wearedevelopers.com/videos/1157-leveraging-large-language-models-for-legacy-code-translation-challenges-and-solutions)

## Related Articles

- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer)