SOC Manager – Lead 24x7 Security Operations

About the role

We are looking for an experienced SOC Manager to lead our 24x7 security operations, overseeing monitoring, triage, investigation and incident response across all shifts. The role combines hands‑on technical leadership with team development and stakeholder communication.

Key responsibilities

• Own 24x7 SOC monitoring, triage, investigation and incident response, including escalation paths and on‑call coverage.
• Define, enforce and audit SOC runbooks, playbooks, SLAs and quality standards.
• Act as incident commander for P1/P2 incidents and coordinate with IT, legal, communications and executive stakeholders.
• Recruit, onboard and develop L1‑L3 analysts, threat hunters and detection engineers; manage shift rosters and career paths.
• Run structured training, tabletop exercises and purple‑team sessions; set performance goals and conduct reviews.
• Lead detection engineering lifecycle: use‑case development, tuning, false‑positive reduction and coverage mapping against MITRE ATT&CK.
• Drive SOAR automation to reduce manual triage effort and integrate threat intelligence.
• Evaluate, tune and govern SIEM, EDR/XDR, NDR, email and cloud security telemetry.
• Define and report SOC KPIs/KRIs (MTTD, MTTR, alert fidelity, SLA adherence, analyst utilization) to leadership and clients.
• Maintain SOC documentation for audits and frameworks such as ISO 27001, SOC 2, NIST CSF.
• Manage tooling budget, vendor relationships and licensing.

Required profile

• 10+ years in cybersecurity with at least 3 years leading a SOC or incident‑response team in a 24x7 environment.
• Proven experience running a SOC for an MSSP or large enterprise serving multiple business units or clients.
• Hands‑on incident command experience on major incidents (ransomware, BEC, insider threat, cloud compromise).
• Deep understanding of attacker tradecraft, MITRE ATT&CK, cyber kill chain and threat‑informed defense.

Required skills

• SIEM platforms (Sentinel, Securonix)
• EDR/XDR solutions (CrowdStrike, Microsoft Defender, SentinelOne)
• SOAR platforms
• MITRE ATT&CK framework
• Threat intelligence integration
• Azure, AWS, GCP cloud environments
• Network, endpoint, identity, email and cloud security telemetry
• Detection engineering and threat hunting
• Incident response and post‑incident review