SOC Manager / SOC Team Lead in Westminster

About the Role We are seeking an experienced and hands-on SOC Manager / SOC Team Lead to establish, lead and continuously improve our internal Security Operations Centre (SOC) within a global enterprise organisation. The successful candidate will play a key role in transitioning SOC operations from an outsourced service to an internally managed capability, building a high-performing security monitoring and incident response function. This role combines operational leadership, technical expertise and the ability to develop efficient and effective cybersecurity processes. Key Responsibilities SOC Leadership & Operations - Lead and manage a team of Tier 1 SOC Analysts operating in a 24/7 shift environment. - Establish operational processes, shift schedules, escalation procedures and performance standards. - Oversee daily SOC operations, alert monitoring, incident triage and initial response. - Ensure consistent operational coverage, effective shift handovers and incident documentation. - Act as the primary operational escalation point for the SOC team. Incident Management & Security Operations - Lead investigations and coordinate security incident response activities with relevant internal teams. - Oversee SIEM, EDR/XDR and other security monitoring platforms. - Improve alert quality, detection coverage, investigation procedures and response playbooks. - Support threat hunting, incident analysis and proactive security improvement. - Develop and maintain incident escalation and communication procedures. SOC Development & Improvement - Support the transition from an outsourced SOC provider to an internally managed SOC. - Define and maintain operational KPIs, SLAs and reporting dashboards. - Identify opportunities for automation, process improvement and reduction of false positives. - Develop analysts through mentoring, training and continuous technical development. - Work closely with the Group Cybersecurity function and IT stakeholders. - Provide regular operational updates, risk insights and incident reporting to cybersecurity leadership. Required Qualifications - 5+ years of experience in cybersecurity operations or SOC environments. - At least 2 years of experience leading SOC analysts, security operations or incident response activities. - Strong hands-on experience with SIEM, EDR/XDR and enterprise security monitoring. - Proven incident investigation, management and escalation experience. - Strong understanding of Microsoft 365 security, identity security, endpoint protection and network security. - Experience building or improving SOC operational processes, playbooks and reporting. - Familiarity with MITRE ATT&CK, threat intelligence and detection engineering. - Ability to combine technical investigation with team leadership and operational management. - Strong communication skills and fluent English. Advantageous Skills - Experience establishing an internal SOC or transitioning from an outsourced SOC/MSSP. - Strong knowledge of Microsoft Sentinel, Microsoft Defender XDR and KQL. - Experience with SOAR and security automation. - Exposure to global, multi-company or multi-tenant enterprise environments. - Relevant certifications such as CISSP, CISM, GCIH, GCIA or SC-200. - Experience developing SOC KPIs, maturity assessments and continuous improvement roadmaps. What We Offer - A key leadership role in developing an internal SOC for a global enterprise. - The opportunity to shape SOC processes, technologies and operational capabilities. - A technically challenging environment with exposure to diverse business units. - Direct collaboration with senior cybersecurity leadership. - Competitive salary and benefits package.