SOC Head

We are looking for a security leader to run the Security Operations Center — the people, processes, and technology that detect, investigate, and respond to threats across endpoints, networks, identities, cloud workloads, and the control plane. This is a Head-of-function role accountable for the enterprise's detection-and-response posture: setting strategy, running 24/7 operations, owning incident command for major events, and reporting security risk to executive leadership. The mandate is measured against hard numbers — dwell time, time to detect, and time to respond — at a moment when the median attacker dwell time for intrusions that succeed sits at roughly eight days.

The defining shift for this seat in 2026 is running an AI-augmented SOC where agentic AI handles the mechanical investigation work — log queries, cross-system correlation, enrichment, and scoring — while senior human analysts make the final containment call. The economics are compelling because the manual baseline is brutal: one survey of security leaders found the average alert waits about 56 minutes before anyone looks at it and takes around 70 minutes to fully investigate. At the same time, autonomous response only works when high-tier analysts validate the meaningful share of cases the AI still gets wrong.

The value this person brings is measurable reduction in dwell time and incident impact, delivered through a well-run, AI-augmented SOC where autonomous actions are bounded, auditable, and safe — treating agents as powerful semi-autonomous users whose access is constrained at the identity, tool, data, and output boundaries.

We are seeking a security-operations leader who has run detection-and-response at scale and can be the calm authority during a major incident. They lead a specialist team across triage, threat intel, detection engineering, and incident response; speak credibly to executives about risk in business terms; and stay current with how AI is reshaping the SOC — including how the traditional tier structure is evolving rather than disappearing as AI absorbs triage and correlation.

This is an executive profile that partners across SOC analysts, threat intelligence, incident response, IT/infrastructure, risk and compliance, and the executive team. It suits someone open to a hybrid engagement with on-site presence for SOC operations, and to mobilization to the Middle East, Europe, or North America depending on the client. The person we want is composed under pressure, rigorous about detection quality, and a builder and retainer of scarce security talent.

A strong candidate for this role has led a SOC or major security function — someone who has owned detection strategy, commanded real incidents, and driven measurable improvements in detection and response times. They have matured a SOC's coverage and metrics, run a blameless post-incident process that actually changed controls, and briefed executives on risk without hiding behind jargon. They bring the judgment to deploy AI in the SOC without losing control of it.

In practice, the responsibilities break down as follows:

• Security operations leadership: Set SOC strategy; run 24/7 monitoring, detection, and response across endpoints, network, identity, cloud, and control-plane activity; own detection standards, playbooks, and SLAs.
• Incident command: Lead incident command for major and critical events; drive blameless post-incident review and translate findings into control improvements — recognizing that automated attack chains can move at machine speed that no manual workflow matches.
• Risk & executive reporting: Report security risk and SOC performance to executive leadership and align to compliance obligations; own the metrics narrative on MTTD, MTTR, and dwell time.
• SLA & operating-model modernization: Rework SOC SLAs for an AI-augmented reality, since many in-production SLAs were written for human-only operations and no longer fit.

We want to see a leader with deep security-operations credibility who can also translate risk into business language for executives. They should be fluent in the modern SOC toolchain and thinking seriously about where AI compresses detection and response — applied with guardrails, not blind trust. The strongest candidates treat guardrails as encoded permissions, thresholds, execution limits, live monitoring, and automatic escalation, not as documentation reviewed after an incident.

Core security operations

• SIEM / SOAR, detection engineering, threat intelligence, and incident response.
• Security frameworks (MITRE ATT&CK, NIST) and compliance alignment.
• SOC metrics and 24/7 shift-operations leadership.

Operational performance (KPIs from research)

• Steers the detection-and-response indicators that matter — MTTD, MTTI, MTTR, dwell time, coverage, and false-positive/false-negative rates.
• Understands the manual baseline being displaced — long alert-wait and investigation times per alert — and sets targets against it.

Modern Agentic AI / AIOps (niche areas we are seeking — depth explored at interview)

• Autonomous triage and remediation agents that reason across SIEM, EDR, and identity data and act within guardrails, with human validation on the cases AI gets wrong.

This role is delivered through Solutions Chapter Group's Human Resources chapter (Chapter 12) as a Recruitment Process Outsourcing (RPO) engagement, under our Executive Search stream. Rather than a "post-and-pray" marketplace approach, we use a Curated Professional Recruitment model: candidate profiles are pre-vetted in our internal database, and when a required profile isn't already available, our dedicated Scout network conducts global headhunting to secure it. We screen and match candidates against each client's specific requirements, and placements may be remote or an on-site deployment with mobilization to the Middle East, Europe, or the United States.

From a recruitment-fit perspective, we screen for:

• Calm, authoritative incident leadership under pressure.
• Clear risk communication to non-technical executives.
• The ability to build and retain scarce security talent.
• A sound balance of automation and human judgment.
• Openness to the engagement model (remote or mobilized on-site) and readiness for cross-region deployment.

Areas to explore at interview *(topics only)*

• Maturing a SOC (coverage, metrics, capability)
• Major-incident command

Security operations leadership, detection & response strategy, incident command, SIEM/SOAR governance, executive risk reporting