Security Operations Center Manager

Position Summary

The SOC Associate Manager is responsible for leading day-to-day Security Operations Centre activities, managing a team of security analysts and team leaders, and ensuring effective monitoring, detection, investigation, containment, and response to cyber security incidents. The role combines operational leadership, technical oversight, service governance, and continuous improvement across enterprise SOC capabilities. The position provides management oversight for major incidents, drives SOC automation and detection maturity, and ensures security monitoring coverage across endpoint, identity, cloud, network, application, email, data, and AI enabled environments. The role collaborates closely with clients, customers, vendors, technology teams, risk functions, and senior leadership to deliver measurable security outcomes and maintain service quality.

Key Responsibilities

SOC Operations & Incident Management

• Lead daily SOC operations, shift governance, workload allocation, alert triage, incident investigation, escalation, and closure.
• Provide management oversight for high-severity and major cyber security incidents, ensuring timely containment, eradication, recovery, communication, and post incident review.
• Act as the escalation point for complex incidents involving ransomware, malware, insider threats, data exfiltration, account compromise, cloud attacks, network intrusions, and advanced persistent threats.
• Ensure compliance with incident response playbooks, standard operating procedures, service-level commitments, and regulatory or contractual obligations.
• Drive root-cause analysis and track corrective and preventive actions through closure.
• Maintain operational readiness for crisis response, on-call support, and major incident coordination.

Leadership, People Management & Team Development

• Lead, coach, and develop SOC analysts, senior analysts, technical leads, and team leaders across shifts and specialised functions.
• Set team objectives, define responsibilities, monitor delivery, and provide regular developmental feedback aligned to role expectations.
• Plan staffing, shift coverage, leave, on-call rosters, succession, cross-training, and skill development to sustain 24x7 operations.
• Build a high-performance culture focused on accountability, collaboration, customer service, technical excellence, and continuous learning.
• Conduct knowledge-sharing sessions, incident reviews, tabletop exercises, and capability assessments.
• Support recruitment, technical interviews, onboarding, performance enablement, retention, and workforce planning.

Threat Detection, Hunting & Engineering

• Oversee development, tuning, validation, and lifecycle management of SIEM correlation rules, analytics, dashboards, and detection use cases.
• Drive proactive threat hunting using threat intelligence, behavioural analytics, MITRE ATT&CK, and hypothesis-based techniques.
• Ensure detection coverage across endpoint, network, identity, cloud, application, email, data, and AI security telemetry.
• Reduce false positives, improve alert fidelity, and establish measurable detection effectiveness and coverage metrics.
• Coordinate with SOAR and engineering teams to automate enrichment, triage, containment, notification, ticketing, and evidence collection workflows.

AI Security

• Oversee monitoring and response for AI and generative AI security risks, including unauthorised AI usage, sensitive data exposure, prompt injection, model abuse, insecure integrations, identity misuse, and anomalous AI service activity.
• Collaborate with AI governance, data protection, cloud, application security, privacy, and risk teams to define monitoring requirements and incident response procedures for AI-enabled solutions.
• Promote secure adoption of AI within SOC operations through governed use of AI-assisted investigation, summarisation, detection engineering, threat intelligence, and automation.
• Validate that AI-enabled security tools maintain appropriate human oversight, auditability, access control, data handling, and evidence retention.
• Track emerging AI-related threats and translate relevant risks into detection, hunting, response, and awareness use cases.

Cloud Security

• Provide SOC oversight for security monitoring across Azure, AWS, Microsoft 365, SaaS, container, and hybrid cloud environments.
• Ensure effective ingestion and correlation of cloud control-plane, identity, workload, network, application, storage, and security platform telemetry.
• Coordinate investigations involving cloud account compromise, privilege escalation, exposed services, misconfiguration, malicious workloads, data access anomalies, and cloud-native attacks.
• Collaborate with cloud engineering, architecture, DevSecOps, application security, and platform teams to improve preventive and detective controls.
• Drive operational use of CSPM, CWPP, CNAPP, CASB, cloud-native security, and identity protection capabilities within SOC workflows.

Network Security

• Oversee monitoring and investigation using firewall, IDS/IPS, NDR, proxy, DNS, VPN, WAF, email gateway, secure web gateway, and network flow telemetry.
• Lead response to network intrusion, command-and-control, lateral movement, data exfiltration, scanning, denial-of-service, malicious domain, and suspicious IP activity.
• Work with network and infrastructure teams on segmentation, access control, perimeter protection, remote access security, and remediation of identified weaknesses.
• Ensure visibility across on-premises, cloud, branch, remote-access, and third-party network connections.
• Support validation of external attack surface and threat intelligence findings related to organisational IP addresses and domains.

Client, Customer & Vendor Engagement

• Act as a primary operational contact for clients and customers on SOC services, incidents, risks, service reviews, improvement plans, and security reporting.
• Lead governance meetings, operational reviews, incident briefings, and executive updates with clear articulation of impact, actions, ownership, and residual risk.
• Collaborate with vendors and managed service partners for product support, escalations, service improvement, roadmap alignment, and issue resolution.
• Participate in customer workshops, audits, assessments, proposals, transitions, and presentations as the SOC subject matter representative.
• Manage stakeholder expectations and maintain strong working relationships across business, technology, security, legal, privacy, compliance, and risk teams.

Service Governance, Reporting & Continuous Improvement

• Define and monitor SOC KPIs, KRIs, SLAs, operational health metrics, detection coverage, case quality, backlog, response performance, and automation benefits.
• Prepare management dashboards, customer reports, incident summaries, trend analysis, and risk-based recommendations.
• Maintain and improve SOC processes, runbooks, playbooks, escalation matrices, knowledge articles, and governance documentation.
• Lead SOC maturity assessments, control validation, purple-team exercises, audit support, lessons learned, and continual service improvement initiatives.
• Identify opportunities for platform consolidation, process standardisation, automation, cost optimisation, and improved security outcomes.
• Ensure evidence quality, case documentation, chain of custody, and reporting standards are maintained for investigations and audits.

Technical Skills

Strong hands-on and managerial knowledge of:

Security Operations Platforms

• SIEM: Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm, or equivalent enterprise platforms.
• EDR/XDR: Microsoft Defender XDR, CrowdStrike Falcon, Palo Alto Cortex XDR, SentinelOne, or equivalent.
• SOAR, case management, threat intelligence, UEBA, NDR, malware analysis, digital forensics, vulnerability

management, attack surface management, and security orchestration technologies.

Security Technologies & Platforms

• Firewalls, IDS/IPS, NDR, DNS security, proxy, VPN, ZTNA, WAF, secure email, secure web gateway, DLP, CASB, IAM, PAM, and identity protection.
• Windows, Linux/Unix, Active Directory, Entra ID, Microsoft 365, Azure, AWS, SaaS, containers, APIs, and hybrid enterprise environments.
• Cloud security platforms including CSPM, CWPP, CNAPP, cloud-native logging, and workload protection capabilities.
• AI security controls, AI governance monitoring, generative AI risk scenarios, and secure use of AI-assisted SOC capabilities.

Security Domains

• Incident Response and Major Incident Management
• Threat Hunting and Threat Intelligence
• Detection Engineering and Security Automation
• Digital Forensics and Malware Analysis
• Cloud, Network, Identity, Application, Data, Email, and AI Security
• MITRE ATT&CK, Cyber Kill Chain, incident lifecycle, risk management, and control validation

Experience

• 12-15 years of overall Information Security experience.
• Minimum 8-10 years of experience in SOC, Incident Response, Threat Hunting, Cyber Defence, Detection Engineering, or related security operations functions.
• Minimum 3-5 years of experience leading SOC teams, team leaders, shift operations, or security service delivery in a managerial or associate managerial capacity.
• Proven experience managing major security incidents and coordinating technical and business stakeholders under pressure.
• Demonstrated experience in AI security, cloud security, and network security monitoring, investigation, and response.
• Experience engaging clients, customers, vendors, managed service providers, auditors, and senior leadership.
• Experience driving SOC transformation, automation, service improvement, metrics, governance, and operational maturity.
• Experience working with enterprise SIEM, EDR/XDR, SOAR, cloud security, network security, and threat intelligence solutions.

Educational Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cyber Security, Engineering, or a related discipline.
• Master's degree or postgraduate qualification in Cyber Security, Information Security, Management, or a related discipline preferred.

Preferred Certifications

One or more of the following:

• CISSP, CISM, or CCSP
• GCIH, GCFA, GNFA, or equivalent SANS/GIAC certification
• Microsoft, AWS, or other recognised cloud security certification
• ISO 27001, ITIL, PMP, or relevant service management / governance certification