SOC INSTRUCTOR - RELOCATION

Experience: 3 years in SOC / detection / threat hunting

About the Role

We are looking for an experienced, hands-on SOC Instructor to teach the defensive Security Operations pathway at one of our international cybersecurity academies. This is a relocation opportunity for a security-operations professional who enjoys teaching, mentoring and building the analysts and threat hunters organizations are hiring for today.

You will own the SOC teaching track end to end — from the shared foundation course that every student takes, through the operational analyst course, into the advanced specializations of threat hunting, detection engineering and AI-augmented defence. You will teach technology-neutral skills using modern SIEM, EDR and cloud telemetry, and you will hold students to the standard that matters most in a real SOC: conclusions validated against evidence.

What You'll Do

• Deliver instructor-led training across the SOC pathway, from foundation through advanced specialization.
• Develop and maintain course materials, hands-on labs, detection exercises, cyber-range scenarios and assessments.
• Guide students through practical investigations and real-world attack simulations on modern SIEM, EDR and cloud telemetry.
• Assess student performance through exercises, capstone investigations, detection packages and examinations.
• Hold students to evidence-based practice — every conclusion, including AI-assisted output, validated against source telemetry.
• Mentor students and support their professional development toward SOC analyst and threat-hunter roles.
• Stay current with emerging threats, detection techniques, cloud/identity attack surfaces and AI in security operations.
• Collaborate with curriculum developers and academy leadership to keep the SOC track current and coherent.
• Support workshops, cyber exercises, hackathons and academy events.

The Essentials

• 3 years of hands-on experience in a SOC, detection engineering, threat hunting, incident response or a closely related security-operations role.
• Strong operational understanding of SOC workflows: alert triage, enrichment, investigation, escalation and tuning.
• Hands-on experience with at least one major SIEM platform — Microsoft Sentinel, Splunk, QRadar, Elastic or similar.
• Experience with EDR/XDR technologies and endpoint security monitoring.
• Working knowledge of MITRE ATT&CK and its use in investigation and detection.
• Working ability to teach AI-assisted SOC workflows and agentic defence at an operational level using and supervising AI assistants/agents with proper validation, approval gates and governance. (Deep adversarial-AI expertise is NOT required; the programme’s AI Security Specialist supports that content.)
• Solid grounding in networking, operating systems (Windows and Linux) and current cyber threats.
• Excellent presentation and communication skills, with the ability to explain technical concepts to learners of varying experience.
• Strong English proficiency, written and spoken.
• Willingness to relocate internationally and work onsite.

Nice to Have

• Previous teaching, training, mentoring or instructional experience (corporate training, bootcamps, military training or university courses).
• Threat-hunting or detection-engineering experience, including detection-as-code practices.
• Familiarity with cloud and identity security monitoring (Entra/Azure, AWS) and container/Kubernetes telemetry.
• Exposure to SOAR platforms and security automation.
• Deeper adversarial-AI or agent-security experience (prompt-injection internals, RAG/model attacks, AI red teaming) — a plus, but co-taught here with the programme’s AI Security Specialist.
• Scripting proficiency in Python, PowerShell or KQL/query languages.
• Certifications such as SC-200, CySA , GCIH, GCIA, GCFA, Security , Blue Team Level (BTL) or CISSP.
• Experience creating cybersecurity labs, detection content or CTF exercises.

What We Offer

• International relocation package.
• The opportunity to shape and teach a modern, end-to-end SOC curriculum.
• A multicultural learning environment and a growing global training organization.
• Access to modern cyber ranges, labs and training platforms.
• Career growth opportunities within a rapidly expanding academy network.