- Job Purpose
The SOC Manager is responsible for leading and managing the Security Operations Center (SOC), ensuring 24/7 monitoring, detection, investigation, and response to cybersecurity threats. The role oversees SOC operations, incident response, threat intelligence, security technologies, team performance, and continuous improvement of the organisation’s cybersecurity posture.
-
Key Responsibilities
-
SOC Operations & Leadership
- Manage day-to-day SOC operations, including 24/7 security monitoring and incident escalation.
- Lead and develop SOC analysts across L1, L2, and L3 teams.
- Establish operational procedures, incident escalation matrices, and service-level agreements (SLAs).
- Security Monitoring & Technology
- Manage and optimise SIEM, SOAR, EDR/XDR, and threat intelligence platforms.
- Oversee SIEM correlation rules, detection engineering, alert tuning, and log-source integration.
- Reduce false positives and improve threat detection coverage.
- Incident Response & Threat Hunting
- Lead major cybersecurity incident investigations and coordinate incident command.
- Manage ransomware containment, forensic investigations, eradication, and recovery.
- Conduct proactive threat hunting using MITRE ATT&CK and threat intelligence.
- Ensure incident response plans and playbooks are tested and regularly updated.
- SOC Strategy & Continuous Improvement
- Develop the SOC strategy, operating model, and maturity roadmap.
- Implement SOAR automation and response playbooks with appropriate approval controls.
- Assess emerging threats and improve detection and response capabilities.
- Performance Management & Reporting
- Define and monitor SOC KPIs, including:
- Mean Time to Detect (MTTD).
- Mean Time to Respond (MTTR).
- SLA compliance and incident resolution.
- Detection coverage and false-positive rates.
- Prepare dashboards, incident reports, and executive-level cybersecurity updates.
- Governance, Risk & Compliance
- Ensure SOC operations align with relevant cybersecurity standards and regulations.
- Maintain compliance with ISO 27001, NIST Cybersecurity Framework, and applicable UAE cybersecurity requirements.
- Support audits, risk assessments, incident documentation, and remediation activities.
- Budget & Vendor Management
- Manage SOC budgets, resource allocation, and security technology investments.
- Oversee managed security service providers (MSSPs), vendor performance, and service delivery.
- Coordinate with IT, infrastructure, cloud, risk, compliance, and senior management teams.
- Required Qualifications
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
- Relevant professional certifications, such as CISSP, CISM, GCIH, GCIA, or equivalent, are desirable.
- Relevant experience managing enterprise SOC operations and cybersecurity incident response.
- Experience in critical infrastructure, government, energy, or other highly regulated environments is an advantage.
- Technical Skills Required
- SIEM: Microsoft Sentinel, Splunk, IBM QRadar, or equivalent.
- SOAR: Security automation, orchestration, and incident-response playbooks.
- EDR/XDR: Microsoft Defender, CrowdStrike, SentinelOne, or equivalent.
- Threat intelligence, threat hunting, and MITRE ATT&CK.
- Digital forensics and incident response (DFIR).
- Detection engineering, correlation rules, log analysis, and security telemetry.
- Incident management, vulnerability management, and security operations reporting.
- Management & Leadership Competencies
- Proven ability to lead and manage SOC analysts and technical specialists.
- Strong incident command and crisis-management capabilities.
- Experience managing SOC budgets, staffing, vendors, and service delivery.
- Excellent communication, stakeholder management, and executive reporting skills.
- Ability to make rapid, risk-based decisions during critical cybersecurity incidents.
