SOC Manager / SOC Team Lead

About the Role

We are seeking an experienced and hands-on  SOC Manager / SOC Team Lead  to establish, lead and continuously improve our internal Security Operations Centre (SOC) within a global enterprise organisation.

The successful candidate will play a key role in transitioning SOC operations from an outsourced service to an internally managed capability, building a high-performing security monitoring and incident response function.

This role combines operational leadership, technical expertise and the ability to develop efficient and effective cybersecurity processes.

Key Responsibilities

SOC Leadership & Operations
- Lead and manage a team of Tier 1 SOC Analysts operating in a 24/7 shift environment.
- Establish operational processes, shift schedules, escalation procedures and performance standards.
- Oversee daily SOC operations, alert monitoring, incident triage and initial response.
- Ensure consistent operational coverage, effective shift handovers and incident documentation.
- Act as the primary operational escalation point for the SOC team.

Incident Management & Security Operations
- Lead investigations and coordinate security incident response activities with relevant internal teams.
- Oversee SIEM, EDR/XDR and other security monitoring platforms.
- Improve alert quality, detection coverage, investigation procedures and response playbooks.
- Support threat hunting, incident analysis and proactive security improvement.
- Develop and maintain incident escalation and communication procedures.

SOC Development & Improvement
- Support the transition from an outsourced SOC provider to an internally managed SOC.
- Define and maintain operational KPIs, SLAs and reporting dashboards.
- Identify opportunities for automation, process improvement and reduction of false positives.
- Develop analysts through mentoring, training and continuous technical development.
- Work closely with the Group Cybersecurity function and IT stakeholders.
- Provide regular operational updates, risk insights and incident reporting to cybersecurity leadership.

Required Qualifications

- 5+ years of experience in cybersecurity operations or SOC environments.
- At least 2 years of experience leading SOC analysts, security operations or incident response activities.
- Strong hands-on experience with SIEM, EDR/XDR and enterprise security monitoring.
- Proven incident investigation, management and escalation experience.
- Strong understanding of Microsoft 365 security, identity security, endpoint protection and network security.
- Experience building or improving SOC operational processes, playbooks and reporting.
- Familiarity with MITRE ATT&CK, threat intelligence and detection engineering.
- Ability to combine technical investigation with team leadership and operational management.
- Strong communication skills and fluent English.

Advantageous Skills

- Experience establishing an internal SOC or transitioning from an outsourced SOC/MSSP.
- Strong knowledge of Microsoft Sentinel, Microsoft Defender XDR and KQL.
- Experience with SOAR and security automation.
- Exposure to global, multi-company or multi-tenant enterprise environments.
- Relevant certifications such as CISSP, CISM, GCIH, GCIA or SC-200.
- Experience developing SOC KPIs, maturity assessments and continuous improvement roadmaps.

What We Offer

- A key leadership role in developing an internal SOC for a global enterprise.
- The opportunity to shape SOC processes, technologies and operational capabilities.
- A technically challenging environment with exposure to diverse business units.
- Direct collaboration with senior cybersecurity leadership.
- Competitive salary and benefits package.