The role leads a global, large and diverse 24x7 cybersecurity attack monitoring function, ensuring effective, timely detection and triage of security events across the enterprise.

The role is accountable for service effectiveness, ensuring that monitoring operations deliver high‑quality, actionable alerts and that case triage is consistent, timely, and aligned to risk.

Key Responsabilities

24x7 Monitoring Operations

• Lead a globally distributed, follow‑the‑sun attack monitoring team

• Ensure continuous coverage across regions with clear ownership, handovers, and operational discipline

• Maintain service resilience, performance, and scalability of monitoring operations

Case Triage & Alert Management

• Own the end‑to‑end triage process for security alerts

• Ensure consistent prioritisation and classification of events based on risk and business impact

• Drive improvements in triage quality, speed, and decisioning consistency

• Act as escalation point for complex or high‑risk cases

Service Effectiveness & Performance

• Define and manage service KPIs (e.g. triage time, alert backlog, escalation quality, false positives)

• Monitor service performance and drive continuous improvement

• Ensure alerts generated are actionable, relevant, and aligned with threat priorities

Operational Governance

• Establish clear playbooks, triage standards, and operating procedures

• Ensure adherence to processes across all regions and shifts

• Provide regular reporting on service performance, risks, and improvement actions

Stakeholder & Incident Alignment

• Work closely with Incident Response teams to ensure seamless escalation

• Align monitoring outputs with threat intelligence and detection engineering

• Provide clear operational insight to senior leadership during significant incidents

Leadership & Team Management

• Lead, develop, and performance manage a global team of analysts and shift leads

• Build a culture of accountability, consistency, and operational excellence

• Ensure effective onboarding, training, and capability uplift across the team

Key Requirements

• Strong experience leading Cyber Security Operations teams at scale

• Proven track record in case triage and alert management

• Ability to drive operational discipline across globally distributed teams

• Experience managing service performance and KPIs

• Clear communication skills across operational and senior stakeholders