SOC Lead - Cyber Security Operations

• Lead and manage 24x7 SOC operations, ensuring consistent, high-quality alert monitoring, triage, and incident response across all markets
• Own and drive SOC service performance against key KPIs including MTTT, MTTR, triage quality, and SLA adherence, delivering measurable improvements in detection quality, response speed, and efficiency
• Oversee the full alert lifecycle, ensuring accurate investigation, containment, escalation, and high-quality incident reporting
• Continuously enhance detection capabilities by improving SIEM use cases, alert logic, and playbooks, reducing false positives and increasing coverage across priority threat scenarios
• Drive the adoption of automation, SOAR, and AI-assisted capabilities to improve speed, consistency, and scalability, with appropriate governance and human oversight
• Lead SOC transformation initiatives focused on reducing alert fatigue, streamlining workflows, and improving analyst productivity
• Build, coach, and develop a high-performing SOC team through structured capability development, performance management, and knowledge sharing
• Act as the final escalation point for complex or high-risk incidents, applying expert judgement to validate and close cases
• Deliver clear, data-driven SOC performance and incident reporting to senior leadership
• Foster a culture of continuous improvement through post-incident reviews, detection retrospectives, and operational learning

• 8+ years in security operations, including at least 4+ years in a SOC leadership or senior incident response role
• Proven leader of 24x7 SOC teams, with a strong track record of improving MTTT/MTTR, triage quality, and operational performance
• Technical authority in incident response, capable of leading complex investigations and making sound decisions under pressure
• Highly experienced with SIEM platforms such as Splunk, Microsoft Sentinel, Google SecOps, ArcSight, or QRadar, and familiar with EDR/NDR technologies
• Skilled in driving SOC automation, SOAR, and AI-enabled capabilities, with a clear understanding of governance and responsible use
• Knowledgeable across network, endpoint, and cloud security, with a strong grasp of attacker techniques and the MITRE ATT&CK framework
• Analytical decision-maker who balances risk, speed, and business impact in ambiguous situations
• Passionate about developing people and building sustainable SOC capability for the future
• Educated to degree level in Cyber Security, Computer Science, Information Technology, or a related discipline (or equivalent practical experience)
• Holder of relevant certifications such as GIAC, CISSP, or vendor-specific SOC certifications
• Committed to continuous learning, innovation, and contribution to the wider security community

Interest or exposure to AI/ML in security

• The opportunity to lead a globally impactful SOC function within a recognised Cyber Defence Centre of Excellence
• Exposure to large-scale, complex cyber defence operations across multiple international markets
• The chance to shape and influence the future of SOC operations through automation and AI-driven transformation
• A collaborative, inclusive environment that supports professional growth and continuous learning
• The ability to work with advanced security technologies and experienced cyber defence professionals