Manager – IT (Security Operations Centre & Incident Response)

Job Overview

We are seeking an experienced Manager – IT (Security Operations Centre & Incident Response) to lead and enhance the organization's enterprise cybersecurity monitoring, detection, and incident response capabilities.

The role will be responsible for overseeing SOC operations, incident response programs, MSSP relationships, security monitoring platforms, threat detection, and cybersecurity operations maturity initiatives. The successful candidate will provide operational leadership during major security incidents and drive continuous improvements in the organization's ability to detect, investigate, respond to, and recover from cyber threats.

Key Responsibilities

• Lead, govern, and continuously improve Security Operations Centre (SOC) functions, processes, and operating models.

• Develop and maintain effective cybersecurity incident response and major incident management processes.

• Lead and coordinate response activities for high-severity and major cybersecurity incidents.

• Manage relationships with Managed Security Service Providers (MSSPs), cybersecurity vendors, and external security partners.

• Oversee the operation and optimization of:

  • SIEM
  • SOAR
  • Log Management
  • EDR/XDR
  • Threat Intelligence Platforms
  • Security monitoring and detection technologies

• Develop and enhance security monitoring, detection rules, alerting, and use cases.

• Lead threat hunting, detection engineering, and security automation initiatives.

• Leverage MITRE ATT&CK and threat intelligence to improve detection and response capabilities.

• Coordinate security incident investigations, root-cause analysis, containment, eradication, and recovery activities.

• Conduct and oversee post-incident reviews and drive corrective and preventive actions.

• Establish and monitor SOC and incident response KPIs, KRIs, SLAs, and operational metrics.

• Continuously assess and improve the maturity of cybersecurity operations, processes, technologies, and capabilities.

• Ensure SOC and incident response activities comply with applicable cybersecurity standards, policies, regulatory requirements, and industry best practices.

• Prepare and present executive-level reports covering security posture, major incidents, operational performance, threat trends, and response effectiveness.

• Support cybersecurity assessments, audits, regulatory reviews, and compliance activities.

• Develop and maintain incident response playbooks, procedures, escalation matrices, and operational documentation.

• Lead, mentor, and develop SOC, incident response, and cybersecurity operations personnel.

• Promote a strong culture of security awareness, continuous improvement, collaboration, and operational excellence.

Required Qualifications & Experience

• Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or a related discipline.
• 7–10 years of experience in SOC operations, incident response, cybersecurity operations, or information security.
• Proven experience leading SOC and/or cybersecurity operations teams.
• Strong hands-on and management experience with:
• SIEM
• SOAR
• EDR/XDR
• Security Monitoring
• Threat Intelligence
• Log Management
• Incident Response
• Strong experience managing MSSPs and cybersecurity technology vendors.
• Proven experience developing and optimizing security detection use cases and monitoring capabilities.
• Strong knowledge of MITRE ATT&CK, threat hunting, incident response methodologies, and security operations best practices.
• Experience handling and coordinating major cybersecurity incidents.
• Strong understanding of cybersecurity risks, vulnerabilities, attack techniques, and enterprise security environments.
• Excellent leadership, communication, analytical, and stakeholder management skills.

Preferred Certifications

Relevant professional certifications such as:

• CISSP – Certified Information Systems Security Professional
• CISM – Certified Information Security Manager
• GIAC / GCIH / GCIA / GCFA
• CompTIA CySA+
• Certified SOC Analyst (CSA) or equivalent
• Other recognized cybersecurity operations or incident response certifications