About the job

Job Responsibilities

Lead the SOC operation

• Own 24x7 monitoring, triage, investigation, and incident response across all shifts, including escalation paths and on-call coverage.
• Define and enforce SOC runbooks, playbooks, SLAs, and quality standards; audit analyst work for consistency and accuracy.
• Serve as incident commander for P1/P2 security incidents and coordinate with IT, legal, communications, and executive stakeholders through resolution and post-incident review.
• 
  

Build and develop the team

• Recruit, onboard, and retain L1–L3 analysts, threat hunters, and detection engineers; manage shift rosters, capacity, and career paths.
• Run structured training, tabletop exercises, and purple-team sessions; set individual performance goals and conduct regular reviews.
• Create a culture of continuous improvement, documentation, and knowledge sharing.
• 
  

Drive detection and response maturity

• Own the detection engineering lifecycle: use-case development, tuning, false-positive reduction, and coverage mapping against MITRE ATT&CK and priority threat actors.
• Lead adoption of SOAR automation to cut manual effort on repetitive triage and enrichment.
• Integrate cyber threat intelligence into detection content, hunting hypotheses, and client/stakeholder advisories.
• Evaluate and tune SIEM, EDR/XDR, NDR, email security, and cloud security telemetry to close visibility gaps.
• 
  

Govern, measure, and report

• Define and report SOC KPIs and KRIs (MTTD, MTTR, alert fidelity, coverage, SLA adherence, analyst utilization) to leadership and [clients].
• Maintain SOC documentation and evidence to support audits and frameworks such as ISO 27001, SOC 2, NIST CSF, and [regional regulatory requirements].
• Manage SOC tooling budget, vendor relationships, licensing, and renewals; build business cases for new capabilities.
• 
  

Engage stakeholders

• Present incident summaries, threat briefings, and service performance to senior leadership and [client CISOs / executive sponsors].
• Act as a trusted advisor on security posture improvements arising from SOC findings.
• [For MSSPs: support pre-sales with SOC service scoping, SLAs, and onboarding of new clients.]