SOC Manager / SOC Team Lead in City of Westminster

About the Role

We are seeking an experienced and hands-on SOC Manager / SOC Team Lead to establish, lead and continuously improve our internal Security Operations Centre (SOC) within a global enterprise organisation.

The successful candidate will play a key role in transitioning SOC operations from an outsourced service to an internally managed capability, building a high-performing security monitoring and incident response function.

This role combines operational leadership, technical expertise and the ability to develop efficient and effective cybersecurity processes.

Key Responsibilities

• SOC Leadership & Operations
• Lead and manage a team of Tier 1 SOC Analysts operating in a 24/7 shift environment.
• Establish operational processes, shift schedules, escalation procedures and performance standards.
• Oversee daily SOC operations, alert monitoring, incident triage and initial response.
• Ensure consistent operational coverage, effective shift handovers and incident documentation.
• Act as the primary operational escalation point for the SOC team.
• Incident Management & Security Operations
• Lead investigations and coordinate security incident response activities with relevant internal teams.
• Oversee SIEM, EDR/XDR and other security monitoring platforms.
• Improve alert quality, detection coverage, investigation procedures and response playbooks.
• Support threat hunting, incident analysis and proactive security improvement.
• Develop and maintain incident escalation and communication procedures.
• SOC Development & Improvement
• Support the transition from an outsourced SOC provider to an internally managed SOC.
• Define and maintain operational KPIs, SLAs and reporting dashboards.
• Identify opportunities for automation, process improvement and reduction of false positives.
• Develop analysts through mentoring, training and continuous technical development.
• Work closely with the Group Cybersecurity function and IT stakeholders.
• Provide regular operational updates, risk insights and incident reporting to cybersecurity leadership.
• Required Qualifications
• 5+ years of experience in cybersecurity operations or SOC environments.
• At least 2 years of experience leading SOC analysts, security operations or incident response activities.
• Strong hands-on experience with SIEM, EDR/XDR and enterprise security monitoring.
• Proven incident investigation, management and escalation experience.
• Strong understanding of Microsoft 365 security, identity security, endpoint protection and network security.
• Experience building or improving SOC operational processes, playbooks and reporting.
• Familiarity with MITRE ATT&CK, threat intelligence and detection engineering.
• Ability to combine technical investigation with team leadership and operational management.
• Strong communication skills and fluent English.
• Advantageous Skills
• Experience establishing an internal SOC or transitioning from an outsourced SOC/MSSP.
• Strong knowledge of Microsoft Sentinel, Microsoft Defender XDR and KQL.
• Experience with SOAR and security automation.
• Exposure to global, multi-company or multi-tenant enterprise environments.
• Relevant certifications such as CISSP, CISM, GCIH, GCIA or SC-200.
• Experience developing SOC KPIs, maturity assessments and continuous improvement roadmaps.

What We Offer

• A key leadership role in developing an internal SOC for a global enterprise.
• The opportunity to shape SOC processes, technologies and operational capabilities.
• A technically challenging environment with exposure to diverse business units.
• Direct collaboration with senior cybersecurity leadership.
• Competitive salary and benefits package.