Security Operations Manager – SOC Lead

About the role

We are looking for a SOC Lead to take professional ownership of Arpya’s Managed Detection and Response service. The role combines leadership of the analyst team with substantial hands‑on technical work, ensuring high‑quality coverage, incident handling and client reporting.

Key responsibilities

• Own daily service operations, including coverage, prioritisation, escalation paths and analyst shift management.
• Maintain and improve incident triage, classification, evidence handling and client‑facing documentation.
• Act as incident commander for major events, directing investigation, containment and client communication.
• Define and drive the detection roadmap, authoring and tuning SIEM/EDR content aligned with MITRE ATT&CK.
• Automate repetitive analyst tasks using SOAR, Python or PowerShell scripts.
• Lead, mentor and develop the analyst team, establishing progression frameworks and quality feedback.
• Conduct client service reviews, translate technical findings into actionable recommendations and advise commercial teams on delivery risk.

Required profile

• Minimum six years in security operations, incident response or CSIRT, with at least two years leading analysts.
• Proven end‑to‑end incident ownership, from triage to post‑incident review.
• Hands‑on experience with at least one enterprise SIEM and one EDR platform (e.g., Microsoft Sentinel, Defender, CrowdStrike).
• Strong knowledge of MITRE ATT&CK for coverage assessment and detection design.
• Ability to write clear client‑facing reports and recommendations in English.

Required skills

• Microsoft Sentinel (SIEM)
• Microsoft Defender or CrowdStrike (EDR)
• Python scripting
• PowerShell scripting
• SOAR automation platforms
• MITRE ATT&CK framework
• Incident response and containment
• Detection engineering and tuning

What we offer

• Ownership of a service in its formative period with authority over standards and procedures.
• Business‑hours role without rotating night shifts; out‑of‑hours duties defined at offer stage.
• Sponsored professional certifications aligned to a defined progression path.
• Direct client responsibility and early decision authority.
• Professional equipment of your choice.