SOC Operations Team Lead

Overview

As the SOC Operations Team Lead, you will lead the day‑to‑day operation of the Security Operations Centre, ensuring the delivery of high‑quality security monitoring, incident response and threat detection services across our Microsoft security platform.

Responsibilities

• Lead the day‑to‑day operation of the Security Operations Centre, ensuring high‑quality security monitoring, incident response and threat detection services.
• Provide technical leadership, mentoring and coaching to SOC Analysts, supporting their development and driving consistent investigation standards.
• Act as the senior escalation point for complex or high‑priority security incidents, providing technical oversight and coordinating response activities.
• Oversee incident investigations using Microsoft Sentinel, Microsoft Defender XDR and Microsoft Entra ID, ensuring incidents are accurately prioritised, investigated and resolved.
• Drive continuous improvement across SOC processes, detection engineering, automation, playbooks and operational procedures to enhance service quality and efficiency.
• Monitor SOC performance against KPIs and SLAs, producing operational reporting and identifying opportunities to improve service delivery.
• Build strong relationships with customers and internal stakeholders, providing technical guidance and contributing to service reviews and operational governance.
• Support onboarding of new security technologies, telemetry sources and Microsoft security capabilities, ensuring they are effectively integrated into SOC operations.
• Promote operational excellence by identifying gaps in tooling, processes or detection coverage and implementing practical improvements.
• Contribute to the ongoing maturity of the SOC, ensuring services remain proactive, resilient and aligned with evolving cyber threats.

Qualifications

• Experience leading, mentoring or supervising analysts within a Security Operations Centre.
• Strong hands‑on experience with Microsoft Sentinel, Microsoft Defender XDR and Microsoft Entra ID.
• Proven experience managing complex cyber security incidents through investigation, containment and resolution.
• Strong understanding of security operations, threat detection, incident response and Microsoft security technologies.
• Experience improving SOC processes, detection capability, automation and operational maturity.
• Ability to lead technical discussions and communicate effectively with customers, stakeholders and internal teams.
• Experience producing operational metrics, reporting and service performance insights.
• Understanding and operating with ITIL Incident Management processes.
• Familiarity with SIEM, SOAR, XDR, MITRE ATT&CK and ITIL‑based service environments.
• Security Clearance

This role requires or will require access to Security Clearance.

Candidates will be asked to complete a Baseline Personnel Security Standard; details of the evidence required to apply may be found on the government website Gov.

UK.

If you are unable to meet this and any associated criteria, then your employment may be delayed or rejected.

Details of this will be discussed with you at interview.

Benefits

• Wellness – 24/7 confidential employee assistance programme.
• Flexible Working – including home working and part time options.
• Social – office parties, breakfast Tuesdays, monthly pizza Thursdays, Thirsty Thursdays, and commitment to charitable causes.
• Time Off – 25 days of annual leave a year, plus bank holidays, with the option to buy 5 extra days each year.
• Volunteering – 2 paid days per year to volunteer in our local communities or within a charity organisation.
• #J-18808-Ljbffr