About the role

We are seeking an experienced and strategic manager to lead and scale our Security Operations Center (SOC). The ideal candidate will be a proven people leader with strong technical expertise in security operations, capable of driving operational excellence, managing a multi-tiered analyst team, and acting as the primary interface between the SOC and executive stakeholders. The SOC Manager will be responsible for SOC delivery, SLA performance across all client engagements, and will champion continuous improvement across people, processes, and technologies, with the ability to scale operations to a 24x7 model as the business evolves.

Key Roles & Responsibilities:

SOC Operations Leadership

• Own the end-to-end performance and delivery of the SOC across all shifts and analyst tiers (L1, L2, L3).
• Define, monitor, and enforce SLAs, KPIs, and OKRs across all client SOC engagements.
• Build and maintain SOC runbooks, playbooks, and standard operating procedures.
• Ensure continuous 24x7 SOC coverage through effective workforce planning and shift management.
• Serve as the final escalation point for high-severity incidents and critical client situations.

Team Management & Development

• Recruit, onboard, and retain a high-performing team of SOC analysts across L1, L2, and L3 levels.
• Conduct regular performance reviews, career development planning, and skills gap assessments.
• Provide coaching and mentorship to build a strong talent pipeline within the SOC.
• Foster a culture of accountability, continuous learning, and operational discipline.
• Manage team scheduling, leave planning, and capacity to ensure uninterrupted operations.

Incident Response Oversight

• Oversee the investigation and resolution of high-severity and P1 security incidents.
• Ensure incident response procedures — containment, eradication, and recovery — are consistently followed.
• Lead post-incident reviews and drive implementation of lessons learned across the team.
• Communicate incident status, impact, and remediation updates to client stakeholders and internal leadership.

Client & Stakeholder Management

• Act as the primary SOC point of contact for strategic client relationships.
• Deliver regular SOC performance reviews, threat landscape briefings, and security posture reports to client executives.
• Collaborate with client IT and security teams to ensure alignment on SOC scope and service effectiveness.
• Manage escalations and ensure client satisfaction through proactive communication and issue resolution.

Threat Intelligence & Threat Hunting Strategy

• Define and oversee the SOC threat intelligence program, ensuring operationalization of feeds across SIEM and detection tools.
• Direct proactive threat hunting initiatives and ensure findings feed back into detection engineering.
• Stay current on the evolving threat landscape and translate emerging attack techniques into actionable SOC improvements.

Security Tool & Technology Governance

• Oversee the selection, deployment, and optimization of security technologies including SIEM (XSIAM/Splunk/QRadar), EDR, XDR, SOAR, and threat intelligence platforms.
• Drive tool rationalization and ensure maximum value from the security technology stack.
• Partner with engineering and architecture teams to evaluate and onboard new tools as the threat landscape evolves.

Metrics, Reporting & Continuous Improvement

• Develop and maintain a comprehensive SOC metrics framework covering MTTR, MTTD, detection rates, false positive ratios, and SLA adherence.
• Produce executive-level and client-facing SOC performance reports on a regular cadence.
• Identify process gaps and lead initiatives to improve analyst efficiency, detection fidelity, and response times.
• Champion SOAR adoption and automation to reduce manual workload and accelerate response.

Compliance & Regulatory Governance

• Ensure SOC operations meet applicable compliance requirements (e.g., GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001).
• Support client audit activities and produce compliance-relevant documentation and evidence.
• Maintain awareness of evolving regulatory requirements affecting security operations.

Cross-Functional Collaboration

• Partner with DFIR, Vulnerability Management, Network Security, and Cloud Security teams to deliver integrated security services.
• Collaborate with MSSPs, OEM vendors, and external threat intelligence partners to strengthen SOC capabilities.
• Work with sales and solution teams to support pre-sales activity, SOC capability presentations, and new client onboarding.

Budget & Resource Planning

• Contribute to SOC budget planning, headcount forecasting, and resource allocation decisions.
• Track and manage operational costs related to tooling, staffing, and third-party services.
• Identify and justify investments in new capabilities that improve security outcomes and operational efficiency.

 Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 8+ years of experience in information security, including experience leading SOC operations or teams.
• Strong hands-on experience with SOC operations, SIEM platforms (e.g., Splunk, QRadar), and incident response.
• Proven ability to manage client relationships and communicate effectively with both technical and executive stakeholders.
• Solid understanding of threat intelligence, threat hunting, and industry security frameworks (e.g., MITRE ATT&CK, NIST, CIS).

 Preferred Qualifications:

• Relevant certifications such as CISSP, CISM, GCIA, or GCIH.
• Experience with SIEM platforms (e.g., Splunk, XSIAM, QRadar) and security tooling.
• Experience with SOAR platforms and security automation.
• Knowledge of cloud security (AWS, Azure, GCP) and hybrid SOC environments.
• Experience in managed security services, including multi-tenant environments or pre-sales support.

About the role

We are seeking a highly skilled Security Analyst to join our Security Operations Center (SOC) team. The ideal candidate should have a strong foundation in SIEM monitoring & XDR or EDR solutions, and security analysis, with hands-on experience in investigating and responding to security alerts. This role requires expertise in reviewing and analyzing L1 alerts, providing detailed recommendations, and engaging with customers for incident handling. The candidate should also have a basic SIEM administration background and Python scripting skills for troubleshooting and playbook development.  

Key Roles & Responsibilities:  

 Incident Detection and Response

• Analyze and Respond to Security Alerts: Review and investigate security alerts escalated from L1 analysts or generated by security monitoring tools (SIEM, IDS/IPS, EDR). 

• Incident Triage: Conduct initial analysis of potential security incidents to determine severity, impact, and scope, including identifying false positives. 

• Incident Escalation: If necessary, escalate incidents to L3 SOC analysts for deeper investigation and remediation. 

• Containment: Take appropriate containment actions to limit the impact of ongoing security incidents (e.g., isolating affected systems, blocking malicious IP addresses). 

• Incident Documentation: Accurately document and report security incidents in a clear and comprehensive manner for later analysis and compliance requirements. 

 Threat Hunting and Monitoring

• Proactive Threat Hunting: Identify potential threats and vulnerabilities by analyzing logs, network traffic, and other security data to find hidden threats or weaknesses. 

• Monitor Security Systems: Regularly monitor and assess security infrastructure, including firewalls, intrusion detection systems, and endpoint protection tools, to detect anomalies and potential attacks. 

• Alert Tuning: Adjust and refine alerts within security tools (SIEM, XDR) to improve detection and reduce false positives. 

 Security Tool Management

• Security Systems and Tools Management: Assist in the configuration, management, and maintenance of security tools (e.g., SIEM & XDR tools) to ensure effective threat detection. 

• Log Review: Review logs from various sources such as network devices, servers, and applications to identify security events or irregular activities. 

• SIEM & XDR Management: Ensure SIEM & XDR tools are operating properly, fine-tune them for better accuracy, and perform searches on security data. 

Collaboration and Escalation 

• Work with L1 Analysts: Provide guidance and mentorship to L1 analysts on how to identify and escalate security incidents appropriately. 

• Collaborate with Other Teams: Coordinate with internal teams (network security, IT operations, application security, etc.) to address vulnerabilities, incidents, and other security concerns. 

• Incident Escalation to L3: For complex or advanced incidents, escalate issues to L3 analysts for deeper investigation and remediation. 

Customer Communication & Incident Handling 

• Engage with customers during security incidents and provide expert guidance. 

• Conduct technical discussions to explain security threats and mitigation steps. 

• Collaborate with internal and external teams for incident resolution. 

Playbook Management & Troubleshooting 

• Understand and modify XDR playbooks to automate security operations. 

• Troubleshoot playbook errors and optimize automation workflows. 

• Identify gaps in existing security automation and recommend enhancements 

 Security Reporting and Documentation

• Prepare Incident Reports: Document detailed incident reports and provide analysis on the severity and impact of security events for management and other stakeholders. 

• Generate Logs and Metrics: Provide regular reports and metrics on security operations, highlighting trends, incidents, and areas of improvement. 

• Compliance Reporting: Ensure that incident records meet internal and external compliance and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS). 

Continuous Improvement

• Contribute to the development and improvement of SOC procedures, workflows, and tools to enhance the efficiency of security monitoring and incident response. 

• Stay Current with Threats: Continuously update knowledge on emerging cybersecurity threats, trends, tools, and techniques to improve threat detection and response. 

• Contribute to Training: Assist in training and developing junior staff (L1 analysts), ensuring the team’s overall readiness to handle incidents. 

 Basic Qualifications: 

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field
• 3+ years of experience in security operations, SIEM, or IT security with solid foundational knowledge
• Hands-on experience with SIEM tools (e.g., Splunk, ArcSight, QRadar), endpoint protection, and IDS/IPS
• Strong understanding of IT infrastructure, networking, and core cybersecurity principles
• Excellent communication, problem-solving skills, and attention to detail

Preferred Qualifications: 

• Relevant security certifications such as CISSP, CISM, GCIA, GCIH, or equivalent
• Experience with modern SIEM platforms (e.g., Palo Alto XSIAM, Google SecOps, FortiSIEM, Splunk)
• Exposure to SOAR platforms and security automation workflows
• Knowledge of cloud security across AWS, Azure, or GCP environments
• Experience working in hybrid or cloud-based SOC environments