SOC Manager

The Role

Client Delivery and Service Management

• Own managed detection and response delivery across a portfolio of clients.
• Act as the primary operational escalation point for clients and internal teams.
• Lead service reviews, governance meetings and executive briefings.
• Present incidents, trends, risks and recommendations clearly and commercially.
• Own performance against SLAs, KPIs and contractual commitments.
• Monitor incident trends, detection coverage, alert volumes, false positives and response performance.
• Create service improvement plans where quality falls below expectations.
• Lead client onboarding and service transition, coordinating deployment, documentation and stakeholders.
• Manage major incident escalations and ensure responses are controlled, communicated and documented.

Team Leadership and People Management

• Line manage and develop SOC Analysts and Senior SOC Analysts.
• Set clear expectations and hold team members accountable for quality and timeliness.
• Conduct one-to-ones, performance reviews and career development discussions.
• Build development plans and support career progression.
• Review investigations, incident reports and client communications.
• Manage workload, capacity, priorities and operational coverage.
• Support recruitment, assessment and onboarding.
• Act as a role model for professionalism, ownership and delivery quality.

Detection, Investigation and Response

• Maintain oversight of detection coverage across client environments.
• Ensure alerts and incidents are investigated consistently and appropriately.
• Provide technical guidance during complex or high-severity incidents.
• Work with analysts, engineers and platform specialists to develop detection use cases.
• Improve detection logic and reduce false positives without weakening coverage.
• Oversee onboarding of new log sources and security technologies.
• Identify opportunities to automate repetitive investigation and response activities.
• Track alert quality, triage, investigation, containment and automation performance.
• Use operational data to identify weaknesses and drive improvement.
• Support threat hunting and the use of threat intelligence.
• Turn incident lessons into improved detections, playbooks and response procedures.
• Maintain awareness of emerging threats, attacker techniques and SOC technologies.

Service Improvement and Practice Development

• Own and improve runbooks, playbooks, workflows and operational procedures.
• Ensure documentation is clear, current and usable during live incidents.
• Standardise investigation, escalation and reporting across client accounts.
• Develop repeatable operating models that allow the SOC to scale without reducing quality.
• Improve quality assurance for alerts, incidents and client deliverables.
• Improve client reporting and service governance.
• Contribute to new managed detection and response services.
• Evaluate security technologies, automation and AI-supported SOC tooling.
• Support proofs of concept and vendor assessments.
• Align operational priorities with the wider SOC roadmap.

Commercial and Business Development

• Support pre-sales discussions for managed detection and response opportunities.
• Explain CyPro’s SOC capabilities clearly to prospective clients.
• Contribute to service designs, proposals, pricing and Statements of Work.
• Estimate onboarding effort, service capacity and technical resource requirements.
• Identify opportunities to improve or expand services for existing clients.
• Understand account profitability and the relationship between scope, capacity and delivery cost.
• Ensure additional requests are assessed, scoped and commercially agreed.

Professional Development

• Maintain your technical and professional credibility through relevant learning and industry engagement.
• Strong candidates will typically hold two or more relevant certifications, or demonstrate equivalent experience. Examples include Microsoft SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, CompTIA CySA+ and CREST Certified Intrusion Analyst.

Soft Skills

• Effective: You remove obstacles, establish ownership and drive work through to completion.
• Accountable and Humble: You take responsibility for SOC performance, accept feedback and change your approach when needed.
• Calm Under Pressure: You remain structured, prioritise clearly and communicate confidently during serious incidents.
• Technically Credible: You understand security operations well enough to challenge investigations, identify weak reasoning and guide the team.
• Client Focused: You provide timely communication, clear recommendations and confidence that the service is well managed.
• People Developer: You invest in your team, give direct feedback and address poor performance.
• Commercially Aware: You balance strong security outcomes with contractual scope, resources and sustainable delivery.
• Adaptable: You make sensible decisions in an evolving environment and help build processes that do not yet exist.

Interview Process

• Telephone Interview: A 20-minute initial conversation with a senior member of the Cyber Security team.
• Psychometric Testing: Three 15-minute cognitive assessments.
• Assessment Centre: A morning in our Canary Wharf office involving practical exercises and a final interview with a practice partner.

We can generally take candidates through the full process within 10 days 🎉.