SOC Lead - Detection & Response

WHO WE ARE Most companies are racing to deploy AI, but very few have the foundation to make it work reliably. Atlan is building that missing layer: the context layer for enterprise AI. We connect the business context behind data so humans and agents can operate with far more accuracy and confidence. With backing from world-class investors including GIC, Insight Partners, Meritech, Peak XV, and Salesforce Ventures, we've earned the trust of most AI-forward enterprises like General Motors, Nasdaq, Workday and Elastic. Come build the infrastructure that AI runs on. THE ROLE We're looking for a SOC Lead who will own Atlan's security operations end-to-end. You lead the function, not a team. You own detection and response outcomes, manage our external SOC vendor, and build the AI-native operations layer that defines what security ops looks like at Atlan. You'll report to the Senior Security Manager and work across Application Security, Platform Security, GRC, and Corporate Security. We expect this person to contribute beyond SOC — whether that's supporting compliance audits, or security automation. WHAT YOU'LL DO - Own SOC operations - Be the single accountable owner for detection, triage, and response at Atlan. Define what good looks like. Hold yourself and the vendor to it. - Manage the managed SOC vendor - Drive day-to-day operations with our external MDR/managed SOC provider. Own the SLA conversations, escalation paths, tuning feedback loops, and monthly reviews. - Build detection and response capability - Develop and continuously improve detection coverage across the security stack. Reduce false positives, improve MTTD and MTTR, and build runbooks and playbooks that the team can actually use. - Build and operate AI agents for SOC - Design and deploy AI agents that handle alert triage, evidence gathering, and investigation summaries autonomously. Move the SOC from reactive-human-only to a model where AI agents do the first pass — and analysts make the calls. Think agentic workflows, not just dashboards. - Lead incident response - Take command of incidents. Run post-mortems. Feed learnings back into controls and detection. Be the point of contact for internal stakeholders and, when needed, external parties. - Drive automation - Security at Atlan is built on automation. You'll write scripts, build n8n workflows, and contribute to our Claude AI-powered security tooling — whether that's auto-enriching alerts, closing remediation loops, or generating incident timelines. We expect you to ship working code, not just spec it out. - Build toward in-house SOC - Develop the roadmap for transitioning from a vendor-heavy model to an in-house capability. Define hiring profiles, tooling requirements, and the right sequencing. - Contribute across security domains - This is a small, high-trust team. You'll contribute to supporting compliance audits, risk assessments, and other security program work — not just SOC operations. - Report to leadership - Maintain a clear picture of Atlan's detection and response posture. Produce regular metrics and narratives for the senior leadership. WHAT WE'RE LOOKING FOR MUST HAVE - 6+ years in security operations, with demonstrated experience building or leading core SOC functions, particularly across detection engineering and incident response. - Hands-on experience with SIEM platforms — alert triage, detection rule development, correlation logic (Splunk preferred) - Experience managing or working closely with a managed SOC or MDR vendor - Strong incident response fundamentals — you've run incidents, written post-mortems, and improved controls as a result - Comfortable with cloud-native environments (AWS/GCP/Azure) and the threat landscape specific to SaaS B2B companies - Experience with EDR platforms (SentinelOne, CrowdStrike, or similar) - Ability to write clearly — incident reports, runbooks, leadership briefings - Hands-on experience building automation — scripts, workflows, or integrations that reduced man