SOC Manager in London

Cyber Security Operations Centre (SOC) Manager: London

Salary

£100,000+ depending on experience

Location

London, on-site 3 days per week with 2 from home

Type

Full-time, permanent

I'm recruiting on behalf of a fast-growing cyber security provider that delivers services to mid-market organisations.

They're hiring a SOC Manager to run and mature their security operations function.

The Opportunity

You'll take ownership of day-to-day MDR delivery across a varied client base, leading a growing team of SOC Analysts and Senior SOC Analysts.

This is a hands-on leadership position.

You won't be watching a queue, and you won't be buried in alerts either.

You'll set the standard for investigation quality, coach your team, and be the person clients and colleagues turn to when something serious happens.

The business is scaling, so there's real scope for the role to grow with it.

What You'll Do

• Service and client delivery
• Own MDR delivery and performance against SLAs, KPIs and contractual commitments
• Act as the senior operational contact for clients and internal teams
• Run service reviews and governance meetings, and brief senior stakeholders on incidents, trends and risks
• Lead client onboarding and service transition
• Manage major incidents so that responses are controlled, communicated and documented
• Put improvement plans in place where service quality slips
• People leadership
• Line manage, coach and develop analysts at all levels
• Run one-to-ones, performance reviews and development planning
• Review investigations, reports and client communications
• Manage workload, capacity and coverage
• Help with recruitment and onboarding
• Build up senior team members so delivery doesn't depend on one person
• Tackle performance issues directly and fairly
• Detection and response
• Oversee detection coverage across client environments
• Provide escalation support and technical guidance on complex or high-severity incidents
• Challenge incomplete analysis and weak conclusions
• Work with engineers and platform specialists to improve detection logic and cut false positives without losing coverage
• Support new log source onboarding, threat hunting and threat intelligence use
• Turn incident lessons into better detections, runbooks and procedures
• Find opportunities to automate repetitive investigation and response work
• Service development
• Own and improve runbooks, playbooks and operational processes
• Standardise investigation, escalation and reporting across clients
• Strengthen quality assurance and client reporting
• Use operational data to prioritise improvements
• Help build an operating model that scales without sacrificing quality
• Evaluate new tooling, including automation and AI-assisted SOC capabilities, and support proofs of concept
• Business support
• Contribute SOC expertise to pre-sales conversations, service design and Statements of Work
• Help estimate onboarding effort and capacity, and ensure new commitments are realistic and deliverable

This is an operational leadership role, not a sales position.

What You'll Bring

Essential

• Experience leading or supervising a SOC or security operations team, in an MSSP/MDR or in-house (multi-client experience is a bonus)
• At least 3 years in security operations, including at least 1 year in a leadership or management capacity
• Strong practical knowledge of SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation and SOC reporting
• Microsoft Sentinel and Defender experience is highly desirable
• Excellent spoken and written English, with confidence communicating complex topics to clients and senior stakeholders
• A solid cyber security or technical background, built through experience, qualifications or education (a degree is not required)
• Existing UK right to work.

Sponsorship cannot be offered.

• Able to commute to the East London office 3 days a week (within roughly 90 minutes door to door)

Certifications

Strong candidates typically hold two or more relevant certifications, or can show equivalent experience.

Examples include SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, Cy SA+ and CREST CIA.

• Personal qualities
• Calm and structured under pressure
• Accountable, open to feedback and willing to adapt
• Technically credible enough to spot weak analysis and guide the team
• A developer of people who gives clear, honest feedback
• Client-focused and commercially aware
• Comfortable building process where none exists yet
• What's on Offer
• 25 days' holiday plus bank holidays, with additional leave for length of service
• Hybrid working: 3 days in a modern East London office, 2 days flexible
• Standard 40-hour week, Monday to Friday, with occasional out-of-hours support for serious incidents
• Annual training plan and budget for a certification or course
• Regular team socials and activities
• Start date as soon as your notice period allows
• Process

The client moves quickly and can usually complete the process in around two weeks: an initial call and an assessment with a final interview.

To apply, send your CV or message me directly for a confidential conversation.