Role Overview :

We are seeking a highly experienced and technically strong SOC Manager to lead and evolve our Security Operations Center into a mature, engineering-driven, and outcome-focused capability in the AI driven world.

This Role Requires a Hybrid Leader Who Can :

- Drive 24x7 SOC operations excellence.

- Own SIEM/SOAR engineering & detection lifecycle.

- Collaborate closely with Product & Development teams.

- Influence platform enhancements through operational intelligence.

- Build and mentor high-performing security teams.

- Highlight risks and gaps in logging methodologies.

- Improve security posture across multi-tenant cloud and on-prem environments.

Key Responsibilities :

SOC Operations Leadership & Incident Governance :

- Lead 24x7 SOC operations including detection, triage, escalation, containment, and recovery.

- Serve as final escalation point (L3/L4) for complex and high-severity incidents.

- Define and enforce incident response lifecycle aligned with NIST, ISO 27001, and MITRE ATT&CK.

- Ensure adherence to SLA / OLA targets (MTTA, MTTR, containment time).

- Conduct executive-level incident briefings and publish detailed RCA reports.

- Ensure compliance with organizational security policies and audit requirements.

- Oversee case quality assurance and investigation standards.

SOC Engineering & Detection Engineering :

- Own SIEM/SOAR architecture optimization and performance tuning.

- Lead log onboarding strategy (cloud, on-prem, hybrid environments).

- Ensure proper log normalization, parsing, enrichment, and correlation.

- Drive full detection use-case lifecycle :

1. Threat modelling.

2. Use-case creation.

3. Validation & tuning.

4. Performance measurement.

5. Decommissioning of ineffective rules.

- Reduce alert fatigue through risk-based alerting, contextual enrichment, and behavioural analytics.

- Implement detection-as-code practices with version-controlled rule management.

- Ensure high ingestion performance and scalable log retention strategies.

Threat Hunting & Advanced Analysis :

- Establish and lead proactive threat hunting programs.

- Map detection coverage against MITRE ATT&CK framework.

- Perform advanced investigations including:

1. Packet capture analysis.

2. Endpoint telemetry analysis.

3. Log correlation across multiple data sources.

- Integrate threat intelligence feeds and manage IOC lifecycle.

- Identify emerging attack patterns and update detection coverage accordingly.

Product Engineering & Platform Enhancement Ownership :

- Act as the primary SOC liaison for Product and Engineering teams.

- Translate operational pain points into structured enhancement requirements.

- Maintain and prioritize a backlog of platform improvements.

- Provide structured feedback on:

1. Detection gaps.

2. Alert noise.

3. Data ingestion latency.

4. Query performance issues.

5. UX inefficiencies impacting analysts.

- Participate in sprint planning and architecture discussions and provide inputs for enhancements.

- Be part of pilot validation of new features prior to production release.

- Quantify impact of enhancements (false positive & incident reduction %, MTTR improvement, automation coverage growth).

Client Onboarding & Security Architecture Oversight :

- Lead secure onboarding of customers across:

1. AWS / Azure / GCP.

2. On-prem data centers.

3. Hybrid architectures.

- Conduct log gap assessments and telemetry validation.

- Align detection coverage to client risk profiles.

- Participate in customer governance calls and QBRs.

- Provide architectural recommendations to improve customer security posture.

Team Leadership & Capability Development :

- Lead, mentor, and manage L1/L2/L3 analysts.

- Establish skill matrix and structured career progression roadmap.

- Conduct periodic case audits and performance reviews.

- Develop training programs in:

1. Advanced detection engineering.

2. Threat hunting.

3. Forensics.

4. Automation.

- Drive hiring, onboarding, and succession planning.

- Build a high-performance, accountability-driven culture.

Metrics, Reporting & Continuous Improvement :

- Define and monitor SOC KPIs:

1. MTTA / MTTR.

2. False positive ratio.

3. Detection accuracy.

4. Automation coverage.

5. Incident recurrence rate & reasoning.

- Publish monthly executive dashboards.

- Conduct quarterly SOC maturity assessments.

- Drive continuous improvement roadmap aligned with business growth.

Mandatory Technical Skills :

- 10-12 years of cybersecurity experience.

- Minimum 4 - 5 years in SOC Lead / SOC Manager role.

- Strong hands-on experience in at least one SIEM platform:

1. Splunk / Sentinel / QRadar / Elastic / AlienVault / DNIF / McAfee ESM.

- Experience implementing SOAR automation.

- Deep understanding of:

1. Network security (Firewall, IDS/IPS, WAF).

2. EDR/XDR platforms.

3. Cloud security (AWS, Azure).

4. Identity & Access Management.

- Strong knowledge of :

1. MITRE ATT&CK & Defend.

2. NIST & NIST IR Framework.

3. Defense-in-Depth architecture.

- Experience with query writing and log analysis on SIEM technologies.

Preferred Technical & Engineering Skills :

- Scripting (Python / PowerShell / Bash) would be added advantage.

- Exposure to DevSecOps environments.

- Knowledge of container and Kubernetes, cloud security.

- Data analytics for anomaly detection.

- Familiarity with compliance frameworks :

1. ISO 27001.

2. SOC 2.

3. PCI-DSS.

4. HIPAA.

Certifications (Preferred) :

- CISSP / CISM.

- CEH.

- CompTIA Security+.

- GIAC Certifications (GCIA / GCIH / GCED).

- Cloud Security Certifications (AWS / Azure / GCP/ Oracle).

Leadership Competencies :

- Strong executive communication and stakeholder management.

- Ability to manage high-pressure incidents.

- Strategic thinking with operational excellence.

- Engineering mindset with product-oriented thinking.

- Strong documentation and governance discipline.

Work Model :

- Mandatory 5-day work from office (Bangalore or Mumbai).

- On-call availability during major incidents or IR situations.

Skills :

- Security Incident Response.

- Communication Skills.

- Collaboration.

- Cybersecurity Strategy.

- Certifications Management.

- Threat Analysis.

- Continuous Learning.

- Leadership Team Management.

- Policy Development.