This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
The Global Security Operations Centre (SOC) is a critical part of the organisation’s security capability, operating 24/7 across three regions. As the SOC Lead, you are responsible for ensuring the continuous monitoring, detection, investigation, and response to cyber threats. You will coordinate teams across all regions to maintain a unified, high‑quality monitoring capability, drive SOC strategy, embed automation and AI-driven improvements, and develop a high‑performing analyst team. This role requires strong leadership, technical understanding, excellent communication skills, and proven experience managing security operations within a global, follow‑the‑sun operating model.
Job Responsibility:
Lead, mentor, and develop SOC analysts across three countries
Oversee day‑to‑day SOC monitoring activities
Provide expert guidance during investigations, escalations, and complex security incidents
Ensure all security events are triaged, investigated, documented, and remediated
Maintain high levels of situational awareness
Contribute to the long‑term SOC strategy
Drive maturity improvements aligned with frameworks
Identify and implement opportunities to enhance analyst effectiveness
Lead annual/quarterly SOC roadmap planning and execution
Drive adoption of AI‑assisted automated triage and machine‑learning‑based threat analysis
Partner with engineering teams to enhance SIEM/SOAR pipelines
Oversee tuning and optimisation of detection rules
Support incident investigations with technical leadership
Ensure learnings from incidents and threat intelligence are captured
Act as the SOC technical point of contact for internal stakeholders
Communicate technical threats clearly to non‑technical audiences
Lead regular SOC operational reviews
Develop and maintain SOC KPIs and OKRs
Track metrics such as MTTD, MTTR, alert volumes, false positives
Ensure continuous performance monitoring
Conduct case reviews, root‑cause analysis, and trend reporting
Build a culture of technical excellence, collaboration, and accountability
Coach and mentor analysts
Conduct performance reviews
Foster an inclusive, high‑trust, globally aligned team environment
Requirements:
4+ years’ experience in SOC operations and security monitoring
Minimum 3 years’ experience leading and developing high‑performing teams
Strong understanding of SIEM platforms
Proven knowledge of MITRE ATT&CK, Cyber Kill Chain, and modern threat actor behaviours
Experience in global follow‑the‑sun SOC operations (desirable but not mandatory)
Strong communication, report writing, presentation, and stakeholder‑facing skills
Experience with SOAR technologies
Experience with detection content and playbooks
Familiarity with cloud environments (Azure, GCP) and cloud security practices
Background in AI/ML security tools or LLM integration within SOC workflows
Nice to have certifications (e.g., GCIH, GCIA, GCFE, GDAT, GCDA, GISP)
Nice to have:
Experience with SOAR technologies
Experience with detection content and playbooks
Familiarity with cloud environments (Azure, GCP) and cloud security practices
Background in AI/ML security tools or LLM integration within SOC workflows
Nice to have certifications (e.g., GCIH, GCIA, GCFE, GDAT, GCDA, GISP)
What we offer:
33 days holiday (including bank holidays) when they join us, increasing the longer you stay with us, up to a maximum of 38 days (including bank holidays)
Option to buy or sell up to an additional five days of annual leave
Eligible for up to £3,600 of free shares each year after one year of service