Cyber Defense Operations Supervisor

About the Role

SOC Supervision

• Supervise day-to-day SOC activities, ensuring continuous security monitoring and timely handling of security alerts and incidents.
• Coordinate SOC shift coverage, workload distribution, task allocation, and operational handovers to support 24/7 monitoring requirements.
• Monitor the effectiveness of security monitoring processes, escalation procedures, and operational workflows.
• Provide technical guidance to SOC analysts and ensure alerts are investigated, documented, and escalated appropriately.
• Support the effective use and ongoing optimization of SIEM, SOAR, and other security monitoring tools.
• Ensure critical systems and applications are integrated into security monitoring through log source onboarding and security telemetry collection.
• Maintain operational documentation, shift reports, incident records, and security monitoring procedures.

Incident Response and Coordination

• Coordinate the initial assessment, investigation, containment, and escalation of cybersecurity incidents in accordance with established procedures.
• Ensure incident response playbooks and escalation procedures are followed and updated as required.
• Support incident response exercises, tabletop exercises, and operational readiness activities.
• Coordinate with relevant technical teams, IT, vendors, and other stakeholders to facilitate timely incident investigation and resolution.
• Escalate major or critical cybersecurity incidents to the Cybersecurity Defense Manager and support incident command and response activities as directed.
• Track incident status, response actions, outstanding issues, and lessons learned to support continuous improvement.
• Ensure incident documentation and post-incident reports are completed accurately and promptly.

Threat Detection and Intelligence

• Supervise security monitoring activities to identify suspicious behavior, emerging threats, and potential security incidents.
• Support the integration of relevant threat intelligence into security monitoring, detection rules, and investigation procedures.
• Coordinate with SOC analysts and technical teams to improve detection use cases and investigate potential threats.
• Monitor detection coverage and identify gaps in security monitoring or alerting capabilities.
• Support the tuning and optimization of detection rules to improve alert quality and reduce false positives.
• Escalate significant threat developments and emerging risks to the Cybersecurity Defense Manager.

Vulnerability Management and Security Controls

• Coordinate vulnerability identification, assessment, prioritization, and remediation tracking in line with established risk criteria and remediation timelines.
• Monitor vulnerability remediation progress and follow up with system owners and technical teams on outstanding issues.
• Support penetration testing activities by coordinating findings, tracking remediation actions, and verifying closure evidence.
• Assist in monitoring the effectiveness of cybersecurity defense controls across network security, endpoint security, identity and access management, and cryptographic controls.
• Escalate critical vulnerabilities, overdue remediation actions, and significant control weaknesses to the Cybersecurity Defense Manager.
• Maintain accurate vulnerability records, remediation status reports, and supporting documentation.

Security Tools, Logging, and Operational Performance

• Monitor the operational effectiveness and availability of security monitoring tools, including SIEM and SOAR platforms.
• Coordinate log source onboarding and verify that critical systems provide the security telemetry required for effective detection and investigation.
• Support the implementation of security event logging, retention, and monitoring requirements.
• Track and report operational KPIs, including MTTD, MTTR, detection coverage, incident volumes, incident severity, and vulnerability remediation status.
• Prepare regular SOC activity reports, incident summaries, and operational performance updates for management review.
• Identify operational gaps and recommend improvements to detection, response, tooling, and incident handling processes.

Major Event Cybersecurity Readiness

• Support cybersecurity operational readiness activities ahead of the tournament, ensuring monitoring processes, escalation paths, and response procedures are tested and understood.
• Coordinate enhanced security monitoring, shift arrangements, and operational readiness during the live event window.
• Support security war-room activities and coordinate incident information with cybersecurity, IT, venue operations, facilities/security teams, and service providers.
• Monitor event-related cybersecurity alerts and escalate significant threats or incidents in accordance with established procedures.
• Support contingency planning, incident simulations, and surge operational arrangements for periods of heightened cyber risk.
• Maintain clear communication and operational handovers throughout match days and other critical event periods.

Team Coordination and Stakeholder Management

• Provide day-to-day supervision, technical guidance, and operational support to SOC analysts and other cybersecurity defense personnel.
• Monitor task completion, adherence to procedures, and the quality of incident investigations and documentation.
• Coordinate operational dependencies with IT, cybersecurity architecture, infrastructure teams, vendors, and other relevant stakeholders.
• Work closely with the Cybersecurity Architecture Manager to ensure new systems and solutions have appropriate security monitoring and detection capabilities before go-live.
• Maintain clear escalation channels and communicate operational risks, incidents, and outstanding actions to the Cybersecurity Defense Manager.
• Contribute to the development of team capabilities, operational procedures, and continuous improvement initiatives.

Requirements

• 2+ years of relevant cybersecurity experience, with significant experience in cybersecurity defense and security operations.
• Proven experience managing or leading SOC / Security Operations functions.
• Strong hands-on and leadership experience in incident response and incident management.
• Experience designing or operating 24/7 SOC environments.
• Understanding of SIEM and SOAR technologies, security monitoring, detection engineering, and log management.
• Experience with threat intelligence and integrating intelligence into security detection and response.
• Knowledge of vulnerability management and penetration testing, including remediation tracking and validation.
• Experience across network security, endpoint security, identity security, and cryptographic controls.
• Experience developing and executing incident response playbooks and tabletop exercises.
• Strong understanding of security metrics and operational KPIs, including MTTD, MTTR, and detection coverage.
• Experience supporting cybersecurity operations during major events would be an advantage.

Preferred Certifications

• Relevant cybersecurity certifications would be an advantage, including CISSP, CISM, GIAC/GCIH/GCIA/GCFA, CEH, Security+, Certified SOC Analyst (CSA), or other recognized cybersecurity, incident response, or security operations certifications.