Manager - SOC

Key Responsibilities 

Security Operations Leadership 

• Own and manage 24x7x365 SOC operations, ensuring continuous monitoring, detection, and response coverage across all shifts, including nights, weekends, and holidays. 

• Design and maintain shift schedules, staffing models, and follow-the-sun or on-call rotations to guarantee round-the-clock coverage without gaps. 

• Lead the SOC's daily operations, including shift coverage, escalation paths, and performance metrics (MTTD, MTTR, alert volume/quality). 

• Define and continuously improve SOC processes, playbooks, and standard operating procedures. 

• Set strategic direction for the SOC in alignment with overall security and business objectives. 

Incident Response & Crisis Management 

• Serve as incident commander for high-severity security incidents, coordinating containment, eradication, and recovery. 

• Maintain and regularly test the incident response plan, including tabletop exercises and post-incident reviews. 

• Coordinate cross-functional crisis response with IT, legal, communications, and executive leadership as needed. 

Threat Detection & Hunting 

• Direct proactive threat hunting programs to uncover hidden or emerging threats not caught by existing detections. 

• Continuously refine detection logic and use cases based on the evolving threat landscape and lessons learned from incidents. 

SIEM/SOAR Management 

• Own the SIEM and SOAR platforms end to end, architecture, content development, tuning, and health monitoring. 

• Partner with engineering to ensure adequate log source coverage, data quality, and retention. 

Threat Intelligence 

• Integrate internal and external threat intelligence into detection engineering, risk assessments, and briefings. 

• Track relevant threat actors, TTPs, and campaigns to inform SOC prioritization. 

Cybersecurity Risk Management 

• Assess and communicate operational security risks, partnering with stakeholders on remediation prioritization. 

• Support exception processes with clear, well-documented rationale. 

Security Automation 

• Drive automation initiatives (SOAR playbooks, scripting, orchestration) to reduce manual effort and improve response times. 

• Identify opportunities to eliminate repetitive analyst tasks through tooling and process redesign. 

People & Stakeholder Management 

• Hire, coach, and develop SOC analysts and engineers; manage performance, staffing, and shift schedules. 

• Build strong partnerships with IT, engineering, legal, and compliance stakeholders. 

Security Governance and Compliance 

• Ensure SOC operations align with internal policy, regulatory requirements, and audit/compliance obligations. 

• Maintain accurate documentation, metrics, and evidence to support audits and governance reviews. 

Communication 

• Deliver clear, concise incident reports, summaries, and operational updates to technical and non-technical audiences. 

• Represent the SOC in cross-functional meetings and executive briefings.