SOC Manager

We are looking for a SOC manager to run day-to-day security operations — leading the analyst team across triage, detection engineering, and incident response, owning shift coverage and SLAs, and being accountable for the detection-and-response metrics that define SOC performance. This is a hands-on management role beneath the head-of-function level: keeping the SOC running well every day, escalating major incidents, and continuously tuning detections against real threats.

The defining shift for this seat in 2026 is running an AI-augmented SOC where agentic AI handles the mechanical investigation work — log queries, cross-system correlation, enrichment, and scoring — while human analysts make the containment call. The manual baseline the SOC is escaping is punishing: one survey found the average alert waits about 56 minutes before anyone looks at it and takes around 70 minutes to fully investigate. The tier structure is evolving rather than disappearing as AI absorbs triage and correlation, and the manager must reshape roles, SLAs, and workflows around that.

The value this person brings is a well-run SOC with strong detection quality and fast response — where automation clears the triage grind and analysts focus on the decisions that matter, all measured against MTTD, MTTR, and dwell time.

We are seeking a security-operations manager who can run the floor — someone who leads analysts across shifts, owns detection quality and response SLAs, and stays calm coordinating a live incident before it escalates to the head of function. They see AI as the way to kill the triage grind, applied with guardrails rather than blind trust.

This profile partners across SOC analysts, detection engineering, threat intelligence, incident response, and IT / infrastructure. It suits someone open to a hybrid engagement with on-site presence for SOC operations, and to mobilization to the Middle East, Europe, or North America depending on the client. The person we want keeps detection sharp and response fast.

A strong candidate for this role has managed a SOC team or shift — someone who has owned detection tuning, run triage and response operations, coordinated incidents, and driven measurable improvements in detection and response times. They bring the judgment to deploy agentic AI in the SOC without losing control of it.

In practice, the responsibilities break down as follows:

• SOC operations management: Lead the analyst team across triage, detection engineering, and response; own shift coverage, SLAs, and daily detection quality.
• Detection engineering & tuning: Own detection standards and playbooks; manage false-positive/false-negative rates and coverage.
• Incident coordination: Coordinate response to incidents; escalate major events to incident command; run post-incident improvement.
• Metrics ownership: Own and report the detection-and-response metrics — MTTD, MTTR, dwell time — that define SOC performance.
• AI-augmented operations: Deploy agentic AI for triage, correlation, enrichment, and scoring while keeping human analysts on the containment decision; reshape tiers and SLAs as AI absorbs the grind.

We want to see a SOC manager with strong operations credibility who can run detection and response day to day and lead a team through it, and who uses agentic AI to compress triage while keeping humans on the decisions. The strongest candidates know the manual baseline they are displacing and set targets against it.

Core security operations

• SIEM/SOAR, detection engineering, threat intelligence, and incident response.
• Security frameworks (MITRE ATT&CK, NIST); SOC shift-operations and SLA management.
• Detection tuning and coverage management.

Operational performance (KPIs from research)

• Steers MTTD/MTTR, dwell time, coverage, and false-positive/false-negative rates — against a manual baseline of long alert-wait and investigation times.

Modern Agentic AI / AIOps (niche areas we are seeking — depth explored at interview)

• Agentic triage agents that query logs, correlate across systems, enrich, and score — with human containment decisions.
• Reshaping the SOC tier model and SLAs as AI absorbs triage and correlation.

This role is delivered through Solutions Chapter Group's Human Resources chapter (Chapter 12) as a Recruitment Process Outsourcing (RPO) engagement, under our Technical Recruitment stream. Rather than a "post-and-pray" marketplace approach, we use a Curated Professional Recruitment model: candidate profiles are pre-vetted in our internal database, and when a required profile isn't already available, our dedicated Scout network conducts global headhunting to secure it. We screen and match candidates against each client's specific requirements, and placements may be remote or an on-site deployment with mobilization to the Middle East, Europe, or the United States.

From a recruitment-fit perspective, we screen for:

• Strong day-to-day SOC operations leadership.
• Detection-engineering and tuning discipline.
• Calm incident coordination.
• Sound balance of automation and human judgment.
• Openness to the engagement model (remote or mobilized on-site) and readiness for cross-region deployment.

Areas to explore at interview *(topics only)*

• Running SOC operations and shifts
• Tuning detections and managing false positives/negatives