Security Operations Manager in London

Job Description

Security Operations Manager - London - 4 days onsite 1 day remote

This is a hands-on leadership role. You need to be technical, in the detail, and able to lead an incident bridge. You will run a global function, and own Security Operations end to end: the SOC, incident response, detection engineering and threat intelligence, along with the people and platforms behind them.

• You will need to have personally led the response to serious cyber incidents.
• You will need to have built a SOC: stood one up, or rebuilt one that wasn't working. The operating model, the hiring, the tooling, the metrics.
• Technical, with a solid grounding in cloud. You understand how modern cloud environments (AWS, GCP, Azure) are attacked and defended, including , logging, lateral movement and containment, and how incident response works within them.
• You will need to have built or led detection programmes covering rule development, coverage mapping, tuning and automation, and you can review a detection and tell whether it is good.
• Threat intelligence experience.
• Experience with threat hunting and purple teaming.