Manager - SOC

1. SOC Operations & Incident Response

• Lead and oversee 24x7 SOC operations, ensuring effective monitoring and timely response to security events.

• Own the end to end incident response lifecycle, including detection, containment, eradication, recovery, and post incident review.

• Act as the primary escalation point for high severity (P1/P2) cybersecurity incidents.

• Ensure incidents are handled within defined SLAs, playbooks, and escalation frameworks.

2. Threat Detection, Monitoring & Response

• Ensure optimal configuration, tuning, and operational effectiveness of security tools including SIEM, SOAR, EDR/XDR, NDR, and UEBA.

• Oversee development and enhancement of use cases, detection rules, and alert correlation logic.

• Lead proactive threat hunting and continuous monitoring activities aligned with emerging threat landscapes.

• Ensure SOC practices align with MITRE ATT&CK, threat intelligence feeds, and industry best practices.

• 
  

3. Governance, Risk & Regulatory Compliance

• Ensure SOC operations comply with:

  • CBUAE Cyber Risk Management regulations

  • ADCB Information Security policies and standards

  • Applicable international frameworks (e.g., NIST, ISO 27001)

• Support internal audits, regulatory examinations, and compliance reviews.

• Maintain up to date SOC documentation including SOPs, runbooks, incident reports, and dashboards.

4. People Management & Capability Development

• Lead, coach, and develop SOC analysts and incident responders (L1/L2/L3).

• Define shift rosters, skill matrices, training plans, and performance objectives.

• Drive continuous capability uplift through training, simulations, table top exercises, and lessons learned.

• Promote a strong security culture and operational discipline within the SOC team.

5. Vendor & Third Party Management

• Manage SOC vendors, MSSPs, and technology partners.

• Monitor vendor performance against contractual SLAs and KPIs.

• Coordinate vendor involvement during incidents, investigations, and forensic activities.

• Support vendor reviews, renewals, and service improvement initiatives.

6. Reporting & Stakeholder Engagement

• Provide regular SOC operational and risk reports to senior management covering:

  • Incident trends and metrics

  • SLA compliance

  • Threat landscape overview

• Brief senior stakeholders during major incidents and crisis situations.

• Collaborate closely with IT Infrastructure, Cloud, GRC, and Business teams.

Key Performance Indicators (KPIs)

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Incident SLA compliance

• Reduction in repeat / high severity incidents

• Audit and regulatory compliance outcomes