SOC Manager

About the role

The SOC Manager leads the Security Operations Center, ensuring 24/7 monitoring, detection, investigation and response to cyber threats. The role drives SOC strategy, manages incident response and continuously improves the organisation's security posture.

Key responsibilities

• Manage day‑to‑day SOC operations, lead L1‑L3 analysts and define procedures, escalation matrices and SLAs.
• Oversee SIEM, SOAR and EDR/XDR platforms, tune alerts, develop correlation rules and reduce false positives.
• Lead major incident investigations, ransomware containment, forensic analysis and proactive threat hunting using MITRE ATT&CK.
• Develop SOC strategy, maturity roadmap and implement automation playbooks.
• Define and monitor KPIs such as MTTD, MTTR, SLA compliance and produce executive dashboards.
• Ensure compliance with ISO 27001, NIST CSF and UAE cybersecurity regulations, supporting audits and risk assessments.
• Manage SOC budget, vendor relationships and coordinate with IT, cloud, risk and senior management.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, IT or related field.
• Professional certifications (CISSP, CISM, GCIH, GCIA) are desirable.
• Proven experience managing enterprise SOC operations and incident response, preferably in regulated sectors.

Required skills

• SIEM platforms: Microsoft Sentinel, Splunk, IBM QRadar.
• SOAR automation and orchestration.
• EDR/XDR solutions: Microsoft Defender, CrowdStrike, SentinelOne.
• Threat intelligence, threat hunting and MITRE ATT&CK framework.
• Digital forensics and incident response (DFIR).
• Detection engineering, log analysis and security telemetry.
• Vulnerability management and security operations reporting.