About the role

We are seeking an experienced and strategic manager to lead and scale our Security Operations Center (SOC). The ideal candidate will be a proven people leader with strong technical expertise in security operations, capable of driving operational excellence, managing a multi-tiered analyst team, and acting as the primary interface between the SOC and executive stakeholders. The SOC Manager will be responsible for SOC delivery, SLA performance across all client engagements, and will champion continuous improvement across people, processes, and technologies, with the ability to scale operations to a 24x7 model as the business evolves.

Key Roles & Responsibilities:

SOC Operations Leadership

• Own the end-to-end performance and delivery of the SOC across all shifts and analyst tiers (L1, L2, L3).
• Define, monitor, and enforce SLAs, KPIs, and OKRs across all client SOC engagements.
• Build and maintain SOC runbooks, playbooks, and standard operating procedures.
• Ensure continuous 24x7 SOC coverage through effective workforce planning and shift management.
• Serve as the final escalation point for high-severity incidents and critical client situations.

Team Management & Development

• Recruit, onboard, and retain a high-performing team of SOC analysts across L1, L2, and L3 levels.
• Conduct regular performance reviews, career development planning, and skills gap assessments.
• Provide coaching and mentorship to build a strong talent pipeline within the SOC.
• Foster a culture of accountability, continuous learning, and operational discipline.
• Manage team scheduling, leave planning, and capacity to ensure uninterrupted operations.

Incident Response Oversight

• Oversee the investigation and resolution of high-severity and P1 security incidents.
• Ensure incident response procedures — containment, eradication, and recovery — are consistently followed.
• Lead post-incident reviews and drive implementation of lessons learned across the team.
• Communicate incident status, impact, and remediation updates to client stakeholders and internal leadership.

Client & Stakeholder Management

• Act as the primary SOC point of contact for strategic client relationships.
• Deliver regular SOC performance reviews, threat landscape briefings, and security posture reports to client executives.
• Collaborate with client IT and security teams to ensure alignment on SOC scope and service effectiveness.
• Manage escalations and ensure client satisfaction through proactive communication and issue resolution.

Threat Intelligence & Threat Hunting Strategy

• Define and oversee the SOC threat intelligence program, ensuring operationalization of feeds across SIEM and detection tools.
• Direct proactive threat hunting initiatives and ensure findings feed back into detection engineering.
• Stay current on the evolving threat landscape and translate emerging attack techniques into actionable SOC improvements.

Security Tool & Technology Governance

• Oversee the selection, deployment, and optimization of security technologies including SIEM (XSIAM/Splunk/QRadar), EDR, XDR, SOAR, and threat intelligence platforms.
• Drive tool rationalization and ensure maximum value from the security technology stack.
• Partner with engineering and architecture teams to evaluate and onboard new tools as the threat landscape evolves.

Metrics, Reporting & Continuous Improvement

• Develop and maintain a comprehensive SOC metrics framework covering MTTR, MTTD, detection rates, false positive ratios, and SLA adherence.
• Produce executive-level and client-facing SOC performance reports on a regular cadence.
• Identify process gaps and lead initiatives to improve analyst efficiency, detection fidelity, and response times.
• Champion SOAR adoption and automation to reduce manual workload and accelerate response.

Compliance & Regulatory Governance

• Ensure SOC operations meet applicable compliance requirements (e.g., GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001).
• Support client audit activities and produce compliance-relevant documentation and evidence.
• Maintain awareness of evolving regulatory requirements affecting security operations.

Cross-Functional Collaboration

• Partner with DFIR, Vulnerability Management, Network Security, and Cloud Security teams to deliver integrated security services.
• Collaborate with MSSPs, OEM vendors, and external threat intelligence partners to strengthen SOC capabilities.
• Work with sales and solution teams to support pre-sales activity, SOC capability presentations, and new client onboarding.

Budget & Resource Planning

• Contribute to SOC budget planning, headcount forecasting, and resource allocation decisions.
• Track and manage operational costs related to tooling, staffing, and third-party services.
• Identify and justify investments in new capabilities that improve security outcomes and operational efficiency.

 Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 8+ years of experience in information security, including experience leading SOC operations or teams.
• Strong hands-on experience with SOC operations, SIEM platforms (e.g., Splunk, QRadar), and incident response.
• Proven ability to manage client relationships and communicate effectively with both technical and executive stakeholders.
• Solid understanding of threat intelligence, threat hunting, and industry security frameworks (e.g., MITRE ATT&CK, NIST, CIS).

 Preferred Qualifications:

• Relevant certifications such as CISSP, CISM, GCIA, or GCIH.
• Experience with SIEM platforms (e.g., Splunk, XSIAM, QRadar) and security tooling.
• Experience with SOAR platforms and security automation.
• Knowledge of cloud security (AWS, Azure, GCP) and hybrid SOC environments.
• Experience in managed security services, including multi-tenant environments or pre-sales support.

Position summary:

We are seeking a skilled Security Consultant to join our Security Operations Center (SOC) team. The ideal candidate will have a strong background in SOC operations and will ensure the SOC team is performing its functions as required, including troubleshooting incidents and events. The ideal Security Consultant will also act as the technical subject matter expert (SME), handling critical SOC tasks, and guiding Level 1 and Level 2 customer communications.

Key Roles & Responsibilities:

Incident Response and Management

• Lead the investigation of high-severity security incidents and breaches.
• Provide expert analysis for complex incidents that L1 and L2 analysts cannot resolve.
• Develop and execute incident response procedures, including containment, eradication, and recovery.
• Ensure proper escalation processes are followed for incidents requiring higher expertise.
• Communicate with stakeholders, such as management and IT teams, to ensure appropriate handling of incidents.

Threat Hunting and Analysis

• Perform proactive threat hunting activities to identify potential vulnerabilities, threats, and attacks before they happen using Splunk / QRadar SIEM.
• Use threat intelligence feeds to enrich SOC operations and identify emerging threats.
• Analyze large volumes of security data to detect patterns and anomalies.

Security Tool Management

• Oversee and optimize the usage of security monitoring tools such as Splunk/ QRadar SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention Systems), and endpoint protection systems.
• Configure, update, and fine-tune security tools to improve detection capabilities and reduce false positives.
• Recommend new security tools and technologies to improve SOC operations.

Log and Event Analysis

• Review logs from various sources (network, endpoints, servers, etc.) to identify security incidents.
• Ensure accurate log data collection and retention practices are followed.
• Provide in-depth analysis of security alerts and generate reports.

Vulnerability Management

• Conduct vulnerability assessments and prioritize remediation activities for critical vulnerabilities.
• Collaborate with the IT and development teams to address security flaws and implement patches.

Collaboration and Escalation

• Serve as the point of escalation for L1 and L2 SOC analysts when complex issues arise.
• Collaborate with other security teams, such as network security, application security, and IT operations, to ensure a comprehensive defense strategy.
• Work with external partners, including Managed Security Service Providers (MSSPs), to coordinate incident management and threat intelligence sharing.

Security Policies and Best Practices

• Review and recommend improvements to security policies, procedures, and best practices.
• Ensure that the organization's security policies are being followed and advise on improvements.
• Conduct regular security awareness training for SOC staff and the broader organization.

Reporting and Documentation

• Generate detailed reports on incidents, security posture, and threats for senior management and relevant stakeholders.
• Maintain incident logs and documentation to comply with regulatory and internal policies.
• Ensure all incidents are well-documented with root cause analysis, remediation efforts, and lessons learned.

Continuous Improvement

• Analyze the effectiveness of the SOC's operations and suggest improvements to processes, workflows, and technologies.
• Stay updated on the latest cyber threats, tools, and techniques.
• Assist with the development and execution of simulations, exercises, and training to improve SOC capabilities.

 Compliance and Regulatory Requirements

• Ensure compliance with SLAs for all projects.
• Ensure SOC operations meet industry compliance requirements (e.g., GDPR, HIPAA, PCI DSS).
• Help in audits and compliance assessments related to security operations.

Mentoring and Training

• Provide mentorship and training to junior SOC analysts (L1 and L2).
• Share knowledge on advanced attack techniques, response strategies, and threat detection methods.

Report deviations and concerns to the SOC Manager

 Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 5+ years of experience in security operations, SIEM, or IT security.
• Hands-on experience with SOC operations, incident response, and security monitoring.
• Solid understanding of cybersecurity fundamentals, networking, and IT infrastructure.
• Strong problem-solving skills and ability to communicate effectively with technical and non-technical stakeholders.

Preferred Qualifications:

• Relevant certifications such as CISSP, CISM, GCIA, or GCIH.
• Experience with SIEM platforms (e.g., Splunk, XSIAM, QRadar) and security tools.
• Experience with SOAR platforms and security automation.
• Knowledge of cloud security (AWS, Azure, GCP) and hybrid SOC environments.
• Familiarity with enterprise security tools (e.g., EDR, XDR, WAF, DLP) and managed SOC environments.

About the role

We are seeking a highly skilled Security Analyst to join our Security Operations Center (SOC) team. The ideal candidate should have a strong foundation in SIEM monitoring & XDR or EDR solutions, and security analysis, with hands-on experience in investigating and responding to security alerts. This role requires expertise in reviewing and analyzing L1 alerts, providing detailed recommendations, and engaging with customers for incident handling. The candidate should also have a basic SIEM administration background and Python scripting skills for troubleshooting and playbook development.  

Key Roles & Responsibilities:  

 Incident Detection and Response

• Analyze and Respond to Security Alerts: Review and investigate security alerts escalated from L1 analysts or generated by security monitoring tools (SIEM, IDS/IPS, EDR). 

• Incident Triage: Conduct initial analysis of potential security incidents to determine severity, impact, and scope, including identifying false positives. 

• Incident Escalation: If necessary, escalate incidents to L3 SOC analysts for deeper investigation and remediation. 

• Containment: Take appropriate containment actions to limit the impact of ongoing security incidents (e.g., isolating affected systems, blocking malicious IP addresses). 

• Incident Documentation: Accurately document and report security incidents in a clear and comprehensive manner for later analysis and compliance requirements. 

 Threat Hunting and Monitoring

• Proactive Threat Hunting: Identify potential threats and vulnerabilities by analyzing logs, network traffic, and other security data to find hidden threats or weaknesses. 

• Monitor Security Systems: Regularly monitor and assess security infrastructure, including firewalls, intrusion detection systems, and endpoint protection tools, to detect anomalies and potential attacks. 

• Alert Tuning: Adjust and refine alerts within security tools (SIEM, XDR) to improve detection and reduce false positives. 

 Security Tool Management

• Security Systems and Tools Management: Assist in the configuration, management, and maintenance of security tools (e.g., SIEM & XDR tools) to ensure effective threat detection. 

• Log Review: Review logs from various sources such as network devices, servers, and applications to identify security events or irregular activities. 

• SIEM & XDR Management: Ensure SIEM & XDR tools are operating properly, fine-tune them for better accuracy, and perform searches on security data. 

Collaboration and Escalation 

• Work with L1 Analysts: Provide guidance and mentorship to L1 analysts on how to identify and escalate security incidents appropriately. 

• Collaborate with Other Teams: Coordinate with internal teams (network security, IT operations, application security, etc.) to address vulnerabilities, incidents, and other security concerns. 

• Incident Escalation to L3: For complex or advanced incidents, escalate issues to L3 analysts for deeper investigation and remediation. 

Customer Communication & Incident Handling 

• Engage with customers during security incidents and provide expert guidance. 

• Conduct technical discussions to explain security threats and mitigation steps. 

• Collaborate with internal and external teams for incident resolution. 

Playbook Management & Troubleshooting 

• Understand and modify XDR playbooks to automate security operations. 

• Troubleshoot playbook errors and optimize automation workflows. 

• Identify gaps in existing security automation and recommend enhancements 

 Security Reporting and Documentation

• Prepare Incident Reports: Document detailed incident reports and provide analysis on the severity and impact of security events for management and other stakeholders. 

• Generate Logs and Metrics: Provide regular reports and metrics on security operations, highlighting trends, incidents, and areas of improvement. 

• Compliance Reporting: Ensure that incident records meet internal and external compliance and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS). 

Continuous Improvement

• Contribute to the development and improvement of SOC procedures, workflows, and tools to enhance the efficiency of security monitoring and incident response. 

• Stay Current with Threats: Continuously update knowledge on emerging cybersecurity threats, trends, tools, and techniques to improve threat detection and response. 

• Contribute to Training: Assist in training and developing junior staff (L1 analysts), ensuring the team’s overall readiness to handle incidents. 

 Basic Qualifications: 

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field
• 3+ years of experience in security operations, SIEM, or IT security with solid foundational knowledge
• Hands-on experience with SIEM tools (e.g., Splunk, ArcSight, QRadar), endpoint protection, and IDS/IPS
• Strong understanding of IT infrastructure, networking, and core cybersecurity principles
• Excellent communication, problem-solving skills, and attention to detail

Preferred Qualifications: 

• Relevant security certifications such as CISSP, CISM, GCIA, GCIH, or equivalent
• Experience with modern SIEM platforms (e.g., Palo Alto XSIAM, Google SecOps, FortiSIEM, Splunk)
• Exposure to SOAR platforms and security automation workflows
• Knowledge of cloud security across AWS, Azure, or GCP environments
• Experience working in hybrid or cloud-based SOC environments

• SOC & MSSP Revenue Generation: Drive end-to-end sales for dedicated/shared SOC services, including the design of operational workflows and human resource outsourcing models.
• Strategic New Business Acquisition: Identify and secure new enterprise logos by positioning Gruve’s integrated security value proposition (Product + Service).
• SOC Service Solutions: Consult with clients to design and sell sophisticated SOC (Security Operations Center) models, focusing on BOT (Build-Operating-Transfer) and MSSP frameworks.
• Direct Enterprise Engagement: Build and lead the end-to-end sales process directly with the client from initial cold outreach and prospecting to executive-level negotiations and closing.
• Holistic Value Proposition: Position Gruve’s integrated portfolio combining product resale with high-value professional services as a strategic advantage for CISOs and CIOs.
• Pipeline and Forecast Management: Maintain an active and healthy pipeline, accurately forecasting both product resale and recurring service revenue.

• 10+ years of Enterprise Sales experience in Cybersecurity, with a proven ability to sell both products (resale) and professional services.
• Proven Hunter Track Record: Demonstrated success in New Logo Acquisition through direct engagement. Candidates with only channel-led or renewal experience will not be prioritized.
• Direct Sales Expertise: Extensive experience managing complex, long-cycle enterprise sales without heavy reliance on third-party channels.
• Security Industry Insight: Strong understanding of the cybersecurity market, including SOC operations.
• Bachelor’s degree in Business, Technology, or a related field.

• Tier-1 Security Vendor Ecosystem: Hands-on experience reselling global Tier-1 cybersecurity solutions or working within leading security vendor environments.
• SOC and Service Model Specialization: Prior experience selling BOT (Build-Operating-Transfer) or MSSP models to multinational corporations.
• APAC Market Experience: Expertise in navigating multi-national customer environments and cross-border deals within the APAC region.
• Consistent Quota Achievement: History of consistently meeting or exceeding 1M dollar plus annual sales quotas (combined product and service revenue).
• Master’s degree or MBA in a related field.