Security Operations Manager

Role overview

What you'll do

• Lead and develop SOC analysts and incident response specialists through operational direction, coaching and support.
• Coordinate cyber incident investigation, containment, eradication, recovery, stakeholder communications and post-incident reviews.
• Assess client Security Operations across people, processes and technology, and translate gaps into practical improvements.
• Advise on SIEM, SOAR, EDR and threat-detection tooling to improve visibility, reduce noise and strengthen response.
• Develop incident playbooks, operating procedures, automated response workflows and tabletop exercises.
• Support modern Security Operations services and share expertise through coaching, mentoring and knowledge sharing.

Security technologies

• Technology may include SIEM and analytics platforms such as Microsoft Sentinel and Splunk.
• Work may involve SOAR and security automation for enrichment, triage and response orchestration.
• EDR/XDR examples include Microsoft Defender for Endpoint and CrowdStrike Falcon.
• Other areas include threat intelligence, detection engineering, investigation and incident response technologies.
• Cloud monitoring environments may include Microsoft Azure, AWS and Google Cloud Platform.

Workplace and collaboration

• Hybrid working includes a minimum expectation of two days per week in an office or at a client site, depending on role and assignment.
• The description also refers to live, in-person working sessions and work from client sites or offices for at least two days per week.

About PA Consulting

Requirements

• Experience leading SOC analysts and incident response specialists.
• Ability to lead hands-on cyber incident investigation, containment, eradication, recovery and post-incident review.
• Ability to advise enterprise and public sector clients on improving security operations capabilities.
• Knowledge of SIEM, SOAR, EDR and threat-detection capabilities and their optimization.
• Ability to develop incident playbooks, operating procedures, automated response workflows and tabletop exercises.
• Ability to coach, mentor and share knowledge with security and technology teams.