Manager – IT (Security Operations Centre & Incident Response)
We are seeking an experienced Manager – IT (Security Operations Centre & Incident Response) to lead and enhance the organization's enterprise cybersecurity monitoring, detection, and incident response capabilities.
The role will be responsible for overseeing SOC operations, incident response programs, MSSP relationships, security monitoring platforms, threat detection, and cybersecurity operations maturity initiatives. The successful candidate will provide operational leadership during major security incidents and drive continuous improvements in the organization's ability to detect, investigate, respond to, and recover from cyber threats.
Key ResponsibilitiesLead, govern, and continuously improve Security Operations Centre (SOC) functions, processes, and operating models.
Develop and maintain effective cybersecurity incident response and major incident management processes.
Lead and coordinate response activities for high-severity and major cybersecurity incidents.
Manage relationships with Managed Security Service Providers (MSSPs), cybersecurity vendors, and external security partners.
-
Oversee the operation and optimization of:
SIEM
SOAR
Log Management
EDR/XDR
Threat Intelligence Platforms
Security monitoring and detection technologies
Develop and enhance security monitoring, detection rules, alerting, and use cases.
Lead threat hunting, detection engineering, and security automation initiatives.
Leverage MITRE ATT&CK and threat intelligence to improve detection and response capabilities.
Coordinate security incident investigations, root-cause analysis, containment, eradication, and recovery activities.
Conduct and oversee post-incident reviews and drive corrective and preventive actions.
Establish and monitor SOC and incident response KPIs, KRIs, SLAs, and operational metrics.
Continuously assess and improve the maturity of cybersecurity operations, processes, technologies, and capabilities.
Ensure SOC and incident response activities comply with applicable cybersecurity standards, policies, regulatory requirements, and industry best practices.
Prepare and present executive-level reports covering security posture, major incidents, operational performance, threat trends, and response effectiveness.
Support cybersecurity assessments, audits, regulatory reviews, and compliance activities.
Develop and maintain incident response playbooks, procedures, escalation matrices, and operational documentation.
Lead, mentor, and develop SOC, incident response, and cybersecurity operations personnel.
Promote a strong culture of security awareness, continuous improvement, collaboration, and operational excellence.
Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or a related discipline.
7–10 years of experience in SOC operations, incident response, cybersecurity operations, or information security.
Proven experience leading SOC and/or cybersecurity operations teams.
Strong hands-on and management experience with:
SIEM
SOAR
EDR/XDR
Security Monitoring
Threat Intelligence
Log Management
Incident Response
Strong experience managing MSSPs and cybersecurity technology vendors.
Proven experience developing and optimizing security detection use cases and monitoring capabilities.
Strong knowledge of MITRE ATT&CK, threat hunting, incident response methodologies, and security operations best practices.
Experience handling and coordinating major cybersecurity incidents.
Strong understanding of cybersecurity risks, vulnerabilities, attack techniques, and enterprise security environments.
Excellent leadership, communication, analytical, and stakeholder management skills.
Relevant professional certifications such as:
CISSP – Certified Information Systems Security Professional
CISM – Certified Information Security Manager
GIAC / GCIH / GCIA / GCFA
CompTIA CySA+
Certified SOC Analyst (CSA) or equivalent
Other recognized cybersecurity operations or incident response certifications