Security Operations Manager

Security Operations Manager - London - 4 days onsite 1 day remote

This is a hands-on leadership role. You need to be technical, in the detail, and able to lead an incident bridge. You will run a global function, and own Security Operations end to end: the SOC, incident response, detection engineering and threat intelligence, along with the people and platforms behind them.

• You will need to have personally led the response to serious cyber incidents.
• You will need to have built a SOC: stood one up, or rebuilt one that wasn't working. The operating model, the hiring, the tooling, the metrics.
• Technical, with a solid grounding in cloud. You understand how modern cloud environments (AWS, GCP, Azure) are attacked and defended, including identity, logging, lateral movement and containment, and how incident response works within them.
• You will need to have built or led detection programmes covering rule development, coverage mapping, tuning and automation, and you can review a detection and tell whether it is good.
• Threat intelligence experience.
• Experience with threat hunting and purple teaming.