Security Operations Manager

About the role

We are seeking a SOC Lead to own Arpya’s Managed Detection and Response service. The role combines leadership of the analyst team with hands‑on technical work on detection platforms, ensuring high‑quality coverage, incident handling and client reporting.

Key responsibilities

• Own the daily operation of the service, including coverage, prioritisation, escalation paths and the analyst team’s operating rhythm.
• Maintain written standards for triage, classification, evidence collection and closure, and review incident records before they reach the client.
• Manage the shift and escalation model, on‑call arrangements and hand‑over discipline.
• Own service metrics reported to clients and the business (acknowledgement time, containment time, false‑positive rate) and act on the insights.
• Act as incident commander for significant incidents: direct investigation, decide containment actions and control client communication.
• Coordinate response with client technical teams and, when needed, third‑party providers or prime contractors.
• Run post‑incident reviews and translate findings into service improvements.
• Lead detection engineering, use‑case development and policy tuning across SIEM, EDR and XDR platforms, ensuring sensor health and appropriate exclusions.
• Oversee vulnerability management, threat‑intelligence integration and readiness activities such as tabletop exercises and ransomware preparedness.

Required profile

• Leadership mindset with the ability to stay credible both with analysts and client IT directors.
• Strong hands‑on technical competence to work directly within security platforms.
• Senior judgement and decision‑making skills under pressure.
• Commitment to delivering high‑quality service standards and continuous improvement.

Required skills

• SIEM
• EDR
• XDR
• Detection engineering
• Use‑case development
• Policy tuning
• Incident response
• Vulnerability management
• Threat intelligence
• Security monitoring of endpoint, identity, email, cloud and network telemetry