Manager - SOC

• 1. SOC Operations & Incident Response

• Lead and oversee
• 24x7 SOC operations
• , ensuring effective monitoring and timely response to security events.
• Own the
• end to end incident response lifecycle
• , including detection, containment, eradication, recovery, and post incident review.
• Act as the
• primary escalation point
• for high severity (P1/P2) cybersecurity incidents.
• Ensure incidents are handled within defined
• SLAs, playbooks, and escalation frameworks
• .

2. Threat Detection, Monitoring & Response

• Ensure optimal configuration, tuning, and operational effectiveness of security tools including

SIEM, SOAR, EDR/XDR, NDR, and UEBA

• .
• Oversee development and enhancement of
• use cases, detection rules, and alert correlation logic
• .
• Lead
• proactive threat hunting
• and continuous monitoring activities aligned with emerging threat landscapes.
• Ensure SOC practices align with

Mitre Att&Ck

• 3. Governance, Risk & Regulatory Compliance

• Ensure SOC operations comply with:
• CBUAE Cyber Risk Management regulations
• ADCB Information Security policies and standards
• Applicable international frameworks (e.g., NIST, ISO 27001)
• Support
• internal audits, regulatory examinations, and compliance reviews
• .
• Maintain up to date SOC documentation including SOPs, runbooks, incident reports, and dashboards.

4. People Management & Capability Development

• Lead, coach, and develop
• SOC analysts and incident responders (L1/L2/L3)
• .
• Define shift rosters, skill matrices, training plans, and performance objectives.
• Drive continuous capability uplift through
• training, simulations, table top exercises, and lessons learned
• .
• Promote a strong security culture and operational discipline within the SOC team.

5. Vendor & Third Party Management

• Manage SOC vendors, MSSPs, and technology partners.
• Monitor vendor performance against
• contractual SLAs and KPIs
• .
• Coordinate vendor involvement during incidents, investigations, and forensic activities.
• Support vendor reviews, renewals, and service improvement initiatives.

6. Reporting & Stakeholder Engagement

• Provide regular
• SOC operational and risk reports
• to senior management covering:
• Incident trends and metrics
• SLA compliance
• Threat landscape overview
• Brief senior stakeholders during major incidents and crisis situations.
• Collaborate closely with IT Infrastructure, Cloud, GRC, and Business teams.

Key Performance Indicators (KPIs)

• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Incident SLA compliance
• Reduction in repeat / high severity incidents
• Audit and regulatory compliance outcomes