> Markdown version of [/jobs/ext/2302264-soc-technical-lead-threat-hunting-incident-response](https://www.wearedevelopers.com/jobs/ext/2302264-soc-technical-lead-threat-hunting-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Technical Lead - Threat Hunting & Incident Response

- **Company:** Thales S21sec
- **Location:** Madrid, Spain (Remote available)
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Distributed Systems, Network Forensics, Security Information and Event Management, Mitre Att&ck, Cybercrime
- **Published:** August 30, 2026
- **Apply:** https://www.adzuna.es/contact-us.html

## About the Role

We are seeking a highly motivated professional with strong expertise in cybersecurity infrastructures, capable of supporting and managing complex technological environments across leading security vendors.
Join the Team Defending Thales' Future At Thales, we don't just respond to threats-we anticipate them. We are looking for a visionary SOC Technical Lead who thrives at the intersection of advanced threat hunting, rapid incident response, and team mentorship. If you are passionate about building resilient security architectures and want to lead a team that is defining the next generation of SOC services, this is your opportunity to make a lasting impact., + Experience: Minimum 2-5 years of experience in Cybersecurity, with a strong focus on Security Operations, Incident Response, or Threat Hunting.

 + Demonstrated experience in a technical lead or senior-level advisory role, guiding teams through complex technical challenges.
 + Proven background in managing security operations within high-scale, distributed environments (Cloud or Hybrid).
 + Advanced understanding of attacker TTPs (Tactics, Techniques, and Procedures) and the MITRE ATT&CK framework.
 + Deep expertise in SIEM/SOAR platforms, EDR/XDR tools, and network traffic analysis.
 + Experience with Cloud security (AWS, Azure, or GCP) and understanding of shared responsibility models.
 + Experience leading large-scale incident investigations and performing root-cause analysis.
 + Familiarity with forensic analysis tools and procedures.

## Description

At Thales S21sec Spain, we are looking for a SOC Technical Lead - Threat Hunting & Incident Response with 4+ years of experience in cybersecurity to join our central services team., + Drive Proactive Defense: You will spearhead our threat hunting strategy, utilizing advanced telemetry and intelligence to uncover sophisticated attacker patterns before they impact our infrastructure.

 + Lead Through Crisis: You will be the technical force behind our Incident Response, guiding the team through high-pressure situations, conducting deep-dive forensics, and refining our defense playbook to stay ahead of the adversary.
 + Mentor and Innovate: You will elevate the talent around you. Through hands-on mentorship, technical workshops, and collaboration, you will cultivate a culture of continuous improvement and technical excellence.
 + Architect the Future: You will partner with our cloud and product teams to integrate security into every stage of the lifecycle. By championing "Security-as-Code" and automation, you will transform how we monitor and protect our global ecosystem.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)
- [Jobs in Tech: The State of the European Market](https://www.wearedevelopers.com/magazine/575-jobs-in-tech-the-state-of-the-european-market)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)