Cyber Operations Manager - SIEM/Incident Response/Azure

Cyber Operations Manager - SIEM/Incident Response/Azure

Salary: £95,000-£110,000 depending on experience
Location: London - hybrid, minimum 60% office attendance
Contract: Permanent

A leading professional services firm is seeking a technically strong Cyber Operations Manager to lead its day-to-day cyber security operations, develop the team and improve detection, response and security engineering capabilities.

Reporting to the Head of Cyber Security, you will combine people management with hands-on technical leadership across security monitoring, incident response, vulnerability management and security controls.

Key responsibilities:

• Lead, coach and develop the cyber security operations team.

• Oversee threat monitoring, investigation and response, acting as a technical escalation point.

• Lead security incidents, coordinating investigation, containment, recovery and post-incident improvements.

• Develop and tune SIEM detection rules, response playbooks and operational procedures.

• Improve security controls across cloud, identity, endpoint, email and network environments.

• Drive threat hunting and translate threat intelligence into defensive improvements.

• Manage vulnerability prioritisation and work with IT teams to deliver timely remediation.

• Manage outsourced security providers and hold suppliers accountable for service performance.

• Provide technical security input into technology projects and change initiatives.

Required experience:

• At least five years' relevant cyber security experience within a regulated environment.

• Proven experience leading cyber security operations teams.

• Strong hands-on security engineering and incident response capabilities.

• Broad technical knowledge covering Azure, Entra ID, SIEM, detection engineering, EDR, email security, identity and access management, vulnerability management, network security and SASE.

• Experience managing outsourced security services.

• Strong communication skills, including explaining technical risks to non-technical stakeholders.

Experience transforming security operations, working with managed SOC services, security automation or purple teaming would be advantageous. Relevant qualifications such as CISSP, CISM or GIAC, or equivalent demonstrable experience, are sought.

This opportunity would suit a technical cyber operations leader who wants to combine team development with direct ownership of improvements to security capability.

Please apply with your CV for further information.