SOC Manager

Job purpose

SOC operations and security technology

• Manage daily SOC operations, continuous security monitoring, and incident escalation.
• Lead and develop L1, L2, and L3 SOC analysts; establish operating procedures, escalation matrices, and service-level agreements.
• Manage and optimize SIEM, SOAR, EDR/XDR, and threat intelligence platforms.
• Oversee correlation rules, detection engineering, alert tuning, and log-source integration; reduce false positives and improve threat detection coverage.

Incident response and strategy

• Lead major cyber incident investigations and coordinate incident command.
• Manage ransomware containment, forensic investigations, eradication, and recovery.
• Conduct proactive threat hunting using MITRE ATT&CK and threat intelligence; test and update incident response plans and playbooks.
• Develop the SOC strategy, operating model, and maturity roadmap; implement SOAR automation and response playbooks with approval controls.
• Assess emerging threats and improve detection and response capabilities.

Performance, governance, and vendors

• Define and monitor MTTD, MTTR, SLA compliance, incident resolution, detection coverage, and false-positive rate KPIs.
• Prepare dashboards, incident reports, and executive-level cybersecurity updates.
• Align SOC operations with relevant standards and regulations, including ISO 27001, NIST Cybersecurity Framework, and applicable UAE cybersecurity requirements.
• Support audits, risk assessments, incident documentation, and remediation activities.
• Manage budgets, resources, security technology investments, MSSPs, vendor performance, and service delivery; coordinate across IT, infrastructure, cloud, risk, compliance, and management.

Qualifications and experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Relevant experience managing enterprise SOC operations and cybersecurity incident response.
• Relevant certifications such as CISSP, CISM, GCIH, GCIA, or equivalent are desirable.
• Experience in critical infrastructure, government, energy, or other highly regulated environments is an advantage.
• Proven ability to lead and manage SOC analysts and technical specialists; experience managing budgets, staffing, vendors, and service delivery.
• Strong incident command, crisis management, communication, stakeholder management, and executive reporting capabilities.
• Ability to make rapid, risk-based decisions during critical cybersecurity incidents.

Technical skills

• SIEM: Microsoft Sentinel, Splunk, IBM QRadar, or equivalent.
• SOAR security automation, orchestration, and incident-response playbooks.
• EDR/XDR: Microsoft Defender, CrowdStrike, SentinelOne, or equivalent.
• Threat intelligence, threat hunting, MITRE ATT&CK, and digital forensics and incident response.
• Detection engineering, correlation rules, log analysis, security telemetry, incident management, vulnerability management, and security operations reporting.