SOC Manager

Job Description

The Security Operations Center (SOC) Manager will lead the transformation and day-to-day operation of a modern, proactive and highly automated security operations function. This individual will oversee SOC operations while driving the organization toward an automation-first, engineering-driven operating model that reduces manual alert processing, improves detection and response capabilities, and enables the security team to identify and address threats more proactively.

A major focus of the role will be advancing security automation, detection engineering, threat hunting, threat intelligence, and incident response. The SOC Manager will develop automated response workflows, improve and customize detection capabilities, identify gaps in security coverage, and establish a mature threat hunting program designed to uncover emerging and previously undetected threats. This leader will also bring together vulnerability management, cloud security, detection data, and incident response into a more unified security operations model.

The SOC Manager will have responsibility for the security platforms supporting the SOC ecosystem, including MDR, cloud security, vulnerability management, and detection technologies, while managing external security partners against defined service levels and outcomes. The role will work closely with Incident Response and other technology teams to continuously improve processes based on lessons learned from security events and evolving threats.

From a leadership perspective, this individual will hire, develop, coach, and manage SOC personnel, while building stronger engineering capabilities within the internal security organization. A key objective will be developing existing team members into more automation-focused security engineers and reducing unnecessary dependence on managed service providers. This person will maintain enough technical depth across the SOC technology stack to effectively challenge technical decisions, guide engineering work, and provide hands-on leadership during significant security incidents.

Ultimately, this role requires a technically credible security operations leader who can balance people leadership with engineering and operational execution. The successful candidate will establish measurable SOC performance metrics, mature operating procedures and crisis communications, and continuously improve the organization's ability to detect, investigate, respond to, and mitigate security threats.

Skills and Requirements

• 4-year college degree, preferably in Computer Science, Information Technology, Computer Engineering, Information Systems or a related technical field.
• 6 years of information security experience.
• 5 years of combined technical experience with major enterprise business systems and related technologies, including experience in management or in a leadership role.
• 4 years of experience working in a Security Operations Center preferred.
• Minimum of 2 years of experience building or operating an automation-driven or Agentic SOC, including detection engineering and security automation, strongly preferred.
• Demonstrated ability to lead employees and external partners, develop SOC talent, manage stakeholder expectations, and drive measurable security operations improvements./span>
• Working knowledge of applicable cybersecurity and compliance frameworks, including NIST, ISO 27001, and PCI DSS.
• Demonstrated ability to prioritize and manage multiple complex assignments with sound judgment, discretion, and professionalism; communicate clearly in writing and verbally; and deliver prompt, transparent, and appropriately targeted incident notifications.
• Strong understanding of security operations metrics and key performance indicators used to measure detection effectiveness, response performance, service quality, and operational maturity.
• Experience using scripting languages such as PowerShell, Python, or Bash to automate security operations, data analysis, and response workflows.
• Broad cybersecurity knowledge, including current threat actors, advanced persistent threat groups, common attack methodologies, tactics, techniques, protocols, and relevant industry trends.
• Demonstrated cyber incident response experience, including applying lessons learned to improve detection, response procedures, and operational readiness.
• Working knowledge of SIEM and security event monitoring, incident response, detection engineering, proactive threat hunting, and SOAR-based automation, with the ability to guide detection tuning, coverage-gap analysis, and automated response workflow development.
• Experience integrating and operating security platforms across detection, cloud, and vulnerability data, including MDR or Agentic SOC models, CNAPP tooling such as Upwind, vulnerability management platforms such as Rapid7 InsightVM, and security operations platforms such as ReliaQuest GreyMatter; experience managing MDR or managed service provider relationships against defined service levels and outcomes.
• Ability to develop actionable telecom-sector threat intelligence that informs detection engineering, threat hunting, and incident response priorities.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to HR@insightglobal.com.