Cyber Security Operations Centre (SOC) Manager: London
Salary: £100,000+ depending on experience
Location: London, on-site 3 days per week with 2 from home
Type: Full-time, permanent
I'm recruiting on behalf of a fast-growing cyber security provider that delivers services to mid-market organisations. They're hiring a SOC Manager to run and mature their security operations function.
The Opportunity
You'll take ownership of day-to-day MDR delivery across a varied client base, leading a growing team of SOC Analysts and Senior SOC Analysts. This is a hands-on leadership position. You won't be watching a queue, and you won't be buried in alerts either. You'll set the standard for investigation quality, coach your team, and be the person clients and colleagues turn to when something serious happens.
The business is scaling, so there's real scope for the role to grow with it.
What You'll Do
Service and client delivery
- Own MDR delivery and performance against SLAs, KPIs and contractual commitments
- Act as the senior operational contact for clients and internal teams
- Run service reviews and governance meetings, and brief senior stakeholders on incidents, trends and risks
- Lead client onboarding and service transition
- Manage major incidents so that responses are controlled, communicated and documented
- Put improvement plans in place where service quality slips
People leadership
- Line manage, coach and develop analysts at all levels
- Run one-to-ones, performance reviews and development planning
- Review investigations, reports and client communications
- Manage workload, capacity and coverage
- Help with recruitment and onboarding
- Build up senior team members so delivery doesn't depend on one person
- Tackle performance issues directly and fairly
Detection and response
- Oversee detection coverage across client environments
- Provide escalation support and technical guidance on complex or high-severity incidents
- Challenge incomplete analysis and weak conclusions
- Work with engineers and platform specialists to improve detection logic and cut false positives without losing coverage
- Support new log source onboarding, threat hunting and threat intelligence use
- Turn incident lessons into better detections, runbooks and procedures
- Find opportunities to automate repetitive investigation and response work
Service development
- Own and improve runbooks, playbooks and operational processes
- Standardise investigation, escalation and reporting across clients
- Strengthen quality assurance and client reporting
- Use operational data to prioritise improvements
- Help build an operating model that scales without sacrificing quality
- Evaluate new tooling, including automation and AI-assisted SOC capabilities, and support proofs of concept
Business support
- Contribute SOC expertise to pre-sales conversations, service design and Statements of Work
- Help estimate onboarding effort and capacity, and ensure new commitments are realistic and deliverable
This is an operational leadership role, not a sales position.
What You'll Bring
Essential
- Experience leading or supervising a SOC or security operations team, in an MSSP/MDR or in-house (multi-client experience is a bonus)
- At least 3 years in security operations, including at least 1 year in a leadership or management capacity
- Strong practical knowledge of SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation and SOC reporting
- Microsoft Sentinel and Defender experience is highly desirable
- Excellent spoken and written English, with confidence communicating complex topics to clients and senior stakeholders
- A solid cyber security or technical background, built through experience, qualifications or education (a degree is not required)
- Existing UK right to work. Sponsorship cannot be offered.
- Able to commute to the East London office 3 days a week (within roughly 90 minutes door to door)
Certifications
Strong candidates typically hold two or more relevant certifications, or can show equivalent experience. Examples include SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, CySA+ and CREST CIA.
Personal qualities
- Calm and structured under pressure
- Accountable, open to feedback and willing to adapt
- Technically credible enough to spot weak analysis and guide the team
- A developer of people who gives clear, honest feedback
- Client-focused and commercially aware
- Comfortable building process where none exists yet
What's on Offer
- Salary of £90,000+
- 25 days' holiday plus bank holidays, with additional leave for length of service
- Hybrid working: 3 days in a modern East London office, 2 days flexible
- Standard 40-hour week, Monday to Friday, with occasional out-of-hours support for serious incidents
- Annual training plan and budget for a certification or course
- Regular team socials and activities
- Start date as soon as your notice period allows
Process
The client moves quickly and can usually complete the process in around two weeks: an initial call and an assessment with a final interview.
To apply, send your CV or message me directly for a confidential conversation.
