SOC Manager

Cyber Security Operations Centre (SOC) Manager: London

Salary: £100,000+ depending on experience

Location: London, on-site 3 days per week with 2 from home

Type: Full-time, permanent

I'm recruiting on behalf of a fast-growing cyber security provider that delivers services to mid-market organisations. They're hiring a SOC Manager to run and mature their security operations function.

The Opportunity

You'll take ownership of day-to-day MDR delivery across a varied client base, leading a growing team of SOC Analysts and Senior SOC Analysts. This is a hands-on leadership position. You won't be watching a queue, and you won't be buried in alerts either. You'll set the standard for investigation quality, coach your team, and be the person clients and colleagues turn to when something serious happens.

The business is scaling, so there's real scope for the role to grow with it.

What You'll Do

Service and client delivery

Own MDR delivery and performance against SLAs, KPIs and contractual commitments

Act as the senior operational contact for clients and internal teams

Run service reviews and governance meetings, and brief senior stakeholders on incidents, trends and risks

Lead client onboarding and service transition

Manage major incidents so that responses are controlled, communicated and documented

Put improvement plans in place where service quality slipsPeople leadership

Line manage, coach and develop analysts at all levels

Run one-to-ones, performance reviews and development planning

Review investigations, reports and client communications

Manage workload, capacity and coverage

Help with recruitment and onboarding

Build up senior team members so delivery doesn't depend on one person

Tackle performance issues directly and fairlyDetection and response

Oversee detection coverage across client environments

Provide escalation support and technical guidance on complex or high-severity incidents

Challenge incomplete analysis and weak conclusions

Work with engineers and platform specialists to improve detection logic and cut false positives without losing coverage

Support new log source onboarding, threat hunting and threat intelligence use

Turn incident lessons into better detections, runbooks and procedures

Find opportunities to automate repetitive investigation and response workService development

Own and improve runbooks, playbooks and operational processes

Standardise investigation, escalation and reporting across clients

Strengthen quality assurance and client reporting

Use operational data to prioritise improvements

Help build an operating model that scales without sacrificing quality

Evaluate new tooling, including automation and AI-assisted SOC capabilities, and support proofs of conceptBusiness support

Contribute SOC expertise to pre-sales conversations, service design and Statements of Work

Help estimate onboarding effort and capacity, and ensure new commitments are realistic and deliverableThis is an operational leadership role, not a sales position.

What You'll Bring

Essential

Experience leading or supervising a SOC or security operations team, in an MSSP/MDR or in-house (multi-client experience is a bonus)

At least 3 years in security operations, including at least 1 year in a leadership or management capacity

Strong practical knowledge of SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation and SOC reporting

Microsoft Sentinel and Defender experience is highly desirable

Excellent spoken and written English, with confidence communicating complex topics to clients and senior stakeholders

A solid cyber security or technical background, built through experience, qualifications or education (a degree is not required)

Existing UK right to work. Sponsorship cannot be offered.

Able to commute to the East London office 3 days a week (within roughly 90 minutes door to door)Certifications

Strong candidates typically hold two or more relevant certifications, or can show equivalent experience. Examples include SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, CySA+ and CREST CIA.

Personal qualities

Calm and structured under pressure

Accountable, open to feedback and willing to adapt

Technically credible enough to spot weak analysis and guide the team

A developer of people who gives clear, honest feedback

Client-focused and commercially aware

Comfortable building process where none exists yet

What's on Offer

Salary of £90,000+

25 days' holiday plus bank holidays, with additional leave for length of service

Hybrid working: 3 days in a modern East London office, 2 days flexible