1. Security Operations Management

• Lead and manage 24x7 SOC operations and security monitoring activities.
• Develop and implement SOC processes, procedures, and operational metrics.
• Ensure timely triage, analysis, escalation, and resolution of security incidents.
• Drive operational excellence through process optimization and automation.
• Manage SOC analysts, incident responders, and threat hunters.

2. Incident Response

• Lead cyber incident response activities for security breaches, malware, ransomware, phishing, insider threats, and advanced persistent threats (APTs).
• Coordinate containment, eradication, recovery, and post-incident reviews.
• Develop and maintain Incident Response Plans, Playbooks, and Runbooks.
• Conduct root cause analysis and lessons learned exercises.
• Collaborate with legal, compliance, IT, and executive leadership during major incidents.

3. Threat Hunting

• Build and mature proactive threat hunting capabilities.
• Develop threat-hunting hypotheses based on intelligence and adversary tactics.
• Perform endpoint, network, cloud, and log-based threat hunting activities.
• Identify stealthy threats, attacker behaviors, and indicators of compromise (IOCs).
• Recommend detection improvements from hunting findings.

4. Threat Intelligence

• Establish and manage Cyber Threat Intelligence (CTI) programs.
• Analyze emerging threats, adversary tactics, techniques, and procedures (TTPs).
• Integrate threat intelligence feeds into SOC operations and SIEM platforms.
• Produce actionable intelligence reports for technical and leadership teams.
• Track global threat actors, vulnerabilities, and industry-specific cyber risks.

5. Threat Detection Engineering

• Design, implement, and continuously improve threat detection use cases.
• Develop SIEM detection rules, correlation searches, and analytics.
• Tune alerts to reduce false positives and improve detection effectiveness.
• Map detections to MITRE ATT&CK framework.
• Work with threat hunters and incident responders to enhance visibility and detection coverage.

6. Security Monitoring & SIEM Management

• Manage SIEM, EDR, NDR, SOAR, and Threat Intelligence platforms.
• Ensure log onboarding, normalization, and retention requirements are met.
• Monitor cloud, endpoint, network, and application security events.
• Drive automation and orchestration initiatives to improve SOC efficiency.

7. Risk, Compliance & Reporting

• Support compliance frameworks such as ISO 27001, NIST CSF, PCI DSS, CIS Controls, SOC2, and GDPR.
• Report cybersecurity posture, KPIs, KRIs, and incident trends to senior management.
• Participate in audits, assessments, and regulatory reviews.

8. Team Leadership

• Mentor and develop SOC analysts and cybersecurity professionals.
• Conduct performance reviews and training programs.
• Build career development and succession plans within the SOC team.
• Foster a culture of continuous learning and operational excellence.

• 8+ years of Cybersecurity experience.
• 3–5+ years of SOC leadership or managerial experience.
• Experience managing enterprise SOC environments and incident response engagements.
• Experience with cloud security monitoring and multi-cloud environments preferred.
• SIEM: Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm
• EDR/XDR: Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black
• SOAR: Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel Automation
• Threat Intelligence Platforms (TIP)

• Network Security, IDS/IPS, Firewall