SOC Manager

Cyber Security Operations Centre (SOC) Manager: London

Salary: £100,000+ depending on experience
Location: London, on-site 3 days per week with 2 from home
Type: Full-time, permanent

I'm recruiting on behalf of a fast-growing cyber security provider that delivers services to mid-market organisations. They're hiring a SOC Manager to run and mature their security operations function.

The Opportunity

You'll take ownership of day-to-day MDR delivery across a varied client base, leading a growing team of SOC Analysts and Senior SOC Analysts. This is a hands-on leadership position. You won't be watching a queue, and you won't be buried in alerts either. You'll set the standard for investigation quality, coach your team, and be the person clients and colleagues turn to when something serious happens.

The business is scaling, so there's real scope for the role to grow with it.

What You'll Do

Service and client delivery

Own MDR delivery and performance against SLAs, KPIs and contractual commitments
Act as the senior operational contact for clients and internal teams
Run service reviews and governance meetings, and brief senior stakeholders on incidents, trends and risks
Lead client onboarding and service transition
Manage major incidents so that responses are controlled, communicated and documented
Put improvement plans in place where service quality slipsPeople leadership

Line manage, coach and develop analysts at all levels
Run one-to-ones, performance reviews and development planning
Review investigations, reports and client communications
Manage workload, capacity and coverage
Help with recruitment and onboarding
Build up senior team members so delivery doesn't depend on one person
Tackle performance issues directly and fairlyDetection and response

Oversee detection coverage across client environments
Provide escalation support and technical guidance on complex or high-severity incidents
Challenge incomplete analysis and weak conclusions
Work with engineers and platform specialists to improve detection logic and cut false positives without losing coverage
Support new log source onboarding, threat hunting and threat intelligence use
Turn incident lessons into better detections, runbooks and procedures
Find opportunities to automate repetitive investigation and response workService development

Own and improve runbooks, playbooks and operational processes
Standardise investigation, escalation and reporting across clients
Strengthen quality assurance and client reporting
Use operational data to prioritise improvements
Help build an operating model that scales without sacrificing quality
Evaluate new tooling, including automation and AI-assisted SOC capabilities, and support proofs of conceptBusiness support

Contribute SOC expertise to pre-sales conversations, service design and Statements of Work
Help estimate onboarding effort and capacity, and ensure new commitments are realistic and deliverableThis is an operational leadership role, not a sales position.

What You'll Bring

Essential

Experience leading or supervising a SOC or security operations team, in an MSSP/MDR or in-house (multi-client experience is a bonus)
At least 3 years in security operations, including at least 1 year in a leadership or management capacity
Strong practical knowledge of SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation and SOC reporting
Microsoft Sentinel and Defender experience is highly desirable
Excellent spoken and written English, with confidence communicating complex topics to clients and senior stakeholders
A solid cyber security or technical background, built through experience, qualifications or education (a degree is not required)
Existing UK right to work. Sponsorship cannot be offered.
Able to commute to the East London office 3 days a week (within roughly 90 minutes door to door)Certifications
Strong candidates typically hold two or more relevant certifications, or can show equivalent experience. Examples include SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, CySA+ and CREST CIA.

Personal qualities

Calm and structured under pressure
Accountable, open to feedback and willing to adapt
Technically credible enough to spot weak analysis and guide the team
A developer of people who gives clear, honest feedback
Client-focused and commercially aware
Comfortable building process where none exists yet

What's on Offer

Salary of £90,000+
25 days' holiday plus bank holidays, with additional leave for length of service
Hybrid working: 3 days in a modern East London office, 2 days flexible
Standard 40-hour week, Monday to Friday, with occasional out-of-hours support for serious incidents
Annual training plan and budget for a certification or course
Regular team socials and activities
Start date as soon as your notice period allows

Process

The client moves quickly and can usually complete the process in around two weeks: an initial call and an assessment with a final interview.

To apply, send your CV or message me directly for a confidential conversation
Only candidates based in UK and eligible to work in UK are allowed