SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Gruve is a Series A agentic AI startup transforming enterprises into AI powerhouses through cybersecurity, customer experience, cloud infrastructure, and advanced technologies including Large Language Models. The Security Operations Lead is a senior individual contributor role reporting to the L3 Operations Lead, responsible for leading technical response on major security and infrastructure incidents until L3 command engagement, and owning the detection-content and tuning program execution day-to-day.
Key responsibilities include: leading technical incident response across security and infrastructure domains; owning the detection-content backlog and tuning program in partnership with the L3 lead; approving and executing high-risk changes; running problem management to eliminate recurring incidents; owning log-pipeline integration health including collectors, GCP Pub/Sub feeds, and custom sources (Redfish listener, Aravolta webhooks, Hubble exporter) with escalation into engineering; cross-training the L1 bench across operational towers; deputizing for the L3 lead during absences; and driving shift-quality audits and post-incident reviews.
Required qualifications: 8–11 years of experience with prior senior/lead experience in SOC (Security Operations Center) or NOC (Network Operations Center) environments; genuine cross-domain fluency across security and infrastructure; incident command capability; deep SIEM content and query skills; advanced network troubleshooting expertise; and an automation mindset.
Desirable qualifications include relevant certifications (GCIH, GCIA, JNCIP, or CCIE written), MSSP or managed-services background, and exposure to AI-SOC tooling. This role offers the opportunity to shape security operations at an early-stage, well-funded startup with strong customer and partner networks in a dynamic, innovation-focused environment.
