Security Operations Manager

Job Summary

Key Responsibilities

• Lead and manage daily Security Operations Center (SOC) activities.
• Supervise, mentor, and develop Tier 1, Tier 2, and Tier 3 security analysts.
• Monitor security alerts and incidents to ensure timely investigation and resolution.
• Lead incident response activities, including containment, eradication, recovery, and post-incident reviews.
• Develop and maintain incident response playbooks, standard operating procedures (SOPs), and escalation processes.
• Coordinate security investigations with internal teams and external partners.
• Oversee the operation and optimization of security platforms, including:
• SIEM (e.g., Splunk, Microsoft Sentinel, Elastic Security, QRadar)
• EDR/XDR
• SOAR
• IDS/IPS
• Email Security

• Threat Intelligence Platforms

• Vulnerability Management tools
• Review, tune, and optimize security detection rules and use cases to minimize false positives and improve threat detection.
• Manage vulnerability remediation efforts with infrastructure and application teams.
• Produce security metrics, dashboards, and executive reports on SOC performance and security posture.
• Ensure compliance with security policies, standards, and regulatory requirements.
• Conduct threat hunting activities and oversee proactive security monitoring.
• Support security audits and compliance assessments.
• Coordinate with third-party MSSPs and security vendors where applicable.
• Lead cyber incident tabletop exercises and improve organizational readiness.
• Stay current with emerging cyber threats, attack techniques, and security technologies.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 7+ years of experience in cybersecurity, with at least 3 years in a leadership or senior SOC role.
• Strong understanding of:
• Security Operations Center (SOC) processes
• Incident Response
• Threat Intelligence
• Threat Hunting
• Security Monitoring

• NIST Cybersecurity Framework

• Experience leading security incident investigations.
• Hands-on experience with SIEM platforms such as Splunk, Elastic Security, Microsoft Sentinel, or QRadar.
• Strong knowledge of Windows, Linux, Active Directory, cloud security (AWS, Azure, OCI, or GCP), and networking fundamentals.
• Experience with endpoint detection and response (EDR/XDR) solutions.
• Familiarity with scripting (PowerShell, Python, Bash) for automation is preferred.

Preferred Certifications

• CISSP
• GCIA
• GCIH
• GCFA
• CEH
• CompTIA Security+
• Splunk Enterprise Security Certified Admin (or equivalent SIEM certification)
• Microsoft SC-200 (if using Microsoft Sentinel)

Technical Skills

• SIEM Management
• Incident Response
• Digital Forensics (basic to intermediate)
• Threat Hunting
• Malware Analysis (basic understanding)
• Log Analysis
• SOAR Automation
• Endpoint Security
• Network Security
• Firewall Technologies
• IDS/IPS
• Email Security
• Cloud Security
• Vulnerability Management
• Security Monitoring
• Security Reporting and Metrics

Leadership & Soft Skills

• Strong leadership and team management skills.
• Excellent communication and stakeholder management.
• Ability to make decisions during high-pressure security incidents.
• Strong analytical and problem-solving skills.
• Experience mentoring and developing security professionals.
• Ability to manage multiple priorities in a fast-paced environment.
• Excellent documentation and reporting skills.

Key Performance Indicators (Kpis)

• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Incident resolution SLA compliance
• Reduction in false-positive alerts
• Detection coverage across critical assets
• Vulnerability remediation compliance
• Security monitoring availability
• SOC process maturity improvements
• Threat hunting effectiveness
• Audit and compliance readiness