Cyber Security Operations Centre (SOC) Manager

Role overview

Client delivery and service management

• Own managed detection and response delivery across a client portfolio and act as the operational escalation point for clients and internal teams.
• Lead service reviews, governance meetings, and executive briefings; communicate incidents, trends, risks, and recommendations.
• Own performance against SLAs, KPIs, and contractual commitments; monitor detection coverage, alert volumes, false positives, and response performance.
• Develop service improvement plans, lead client onboarding and service transitions, and coordinate deployment, documentation, and stakeholders.
• Manage major incident escalations and ensure responses are controlled, communicated, and documented.

Team leadership

• Line-manage, coach, and develop SOC Analysts and Senior SOC Analysts; set expectations for investigation quality, ownership, communication, and timeliness.
• Conduct one-to-ones, performance reviews, and career development discussions; build development plans and support progression.
• Review investigations, incident reports, and client communications; manage workload, priorities, operational coverage, and capacity.
• Support recruitment, assessment, and onboarding, and develop senior team members.

Technical improvement

• Work with technical, engineering, and client-facing teams to improve detections, investigations, automation, processes, and reporting.
• Provide technical oversight without focusing solely on personally investigating alerts or supervising an alert queue.

Minimum requirements

• Experience leading or supervising a SOC or security operations team in an MSSP/MDR provider or in-house environment; supporting multiple clients is useful but not essential.
• Strong practical knowledge of SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation, and SOC reporting.
• Microsoft Sentinel and Defender experience is highly desirable.
• Clear, confident spoken and written English communication with clients and senior stakeholders.
• Already have the right to work in the UK and be able to work from the Canary Wharf office three days per week; visa sponsorship is unavailable.
• A strong background in cyber security or a related technical discipline, gained through experience, qualifications, or education; a degree is not mandatory.

Workplace

• Work from the Canary Wharf office three days per week, with flexibility for the remaining two days.

Hours and availability

• 40 hours, Monday to Friday, with occasional support for serious incidents outside normal hours.

Pay and benefits

• Salary is £90,000 or more, depending on experience; the description does not specify a pay cadence.
• Holiday includes 25 days, bank holidays, and one additional day for every 12 months of service.
• An individual training plan and budget are provided for one professional certification or course each year.

About CyPro