Security Operations Centre Manager

As our Security Operations Centre Manager you will be responsible for managing activities relating to monitoring and responding to security events. Additionally, you will be responsible for the development and oversight of the SOC program to ensure personnel are managed and operational efficiencies are maintained. You will work with multiple technology platforms and interfaces with other groups within Information Security, IT operations, and other technology and business functions.

You will have technical competence and experience managing diverse teams, and familiarity with recent threats and adversarial techniques, as well as the ability to quickly understand complex environments. Business and interpersonal skills are essential to manage risk to the business, interface with other business units, and develop SOC analysts. You will contribute to the company security strategy and roadmap and will be able to clearly communicate to team members at all levels.

This role can be based remotely across the UK, however living within commutable distance to our Cambridge office is a definite plus! If you’re based remotely, you will ideally be happy to travel to our Cambridge office several times throughout the year.

• Lead a team of security analysts and incident responders to ensure effective 24x7x365 security monitoring and incident response operations
• Manage relationships with third-party providers of SOC technologies and services
• Manage security event investigations, partnering with other departments as needed
• Identify opportunities to support and improve performance through learning plans and development plans that enhance the skills and knowledge of SOC team members, establishing a culture of continuous improvement
• Oversee the day-to-day operations of the SOC, including staffing, monitoring and analysing system events, detecting and investigating incidents, and ensuring timely and appropriate response and resolution
• Develop and implement SOC playbooks, policies, procedures, and standards to ensure consistent and effective security operations
• Stay current with the latest cybersecurity threats, vulnerabilities, and attack methodologies to continuously improve the effectiveness of the SOC
• Define, track, and report key performance indicators (KPIs) and metrics to measure the performance and efficiency of the SOC team and the technologies it utilises
• Coordinate and participate in incident response activities, including investigations, escalations, remediation, root cause analysis, and post-incident reporting
• Plan and execute regular incident response and post-mortem exercises, with a focus on creating measurable benchmarks to show progress (or deficiencies requiring additional attention)
• Coordinate and participate in table-top exercises and other simulations that validate the effectiveness of SOC playbooks and company response plans
• Provide regular reports and updates to senior management and stakeholders on the status of security incidents, threat landscape, and SOC performance
• Identify requirements and drive improvements to the security operations procedures, policies, and standards
• Ensure that technologies utilised by the SOC are properly configured, optimized, and fully deployed to provide maximum value
• Partner with the security engineering team to improve tool usage and workflow, as well as with the advanced threats and assessment team to mature monitoring and response capabilities
• Drive improvements in incident detection and response processes, including through the identification and implementation of new tools and technologies
• Manage and oversee the day-to-day operations of the in-place security solutions
• Facilitate project work relating to the selection, testing, deployment, configuration and lifecycle management of SOC technologies

Must haves:

• Bachelor’s degree in Computer Science, Information Security, or a related field
• Significant experience in cybersecurity, with experience of managing a Security Operations Centre or incident response team
• Deep understanding of security technologies, threat detection methodologies, and incident response processes
• Strong knowledge of cybersecurity frameworks, standards, and regulations
• Excellent leadership, communication, and interpersonal skills with the ability to effect change through influence at all levels of the organisation
• Experience in investigations using formal chain-of-custody methods, forensic tools and best practices
• Attention to detail, with the ability to succinctly communicate the key aspects of best security practice to non-technical stakeholders
• Proven ability to manage and prioritise multiple tasks in a fast-paced environment, with the ability to adapt to changing threat landscapes and technology trends
• Experience with cloud security and emerging technologies
• Strong problem-solving and critical-thinking skills
• Strong technical skills relevant to security operations and information security, including:
  • Network security
  • Security information and event management
  • Identity and access management
  • Data loss prevention
  • Vulnerability assessment and mitigation
  • Business Impact Assessments
  • Threat Analysis

Great to haves

• Industry-recognized certifications such as CISSP, CISM, CISA, GIAC, or certifications in incident handling and computer forensics
• Master’s degree in related field

Here at Featurespace we are committed to being a place of equality, inclusion and respect to provide a safe environment for you to bring your authentic self to work. We know that we gain as much strength from our differences as we do our similarities. We value diversity and are dedicated to listening and learning from each other to build and maintain a positive and productive culture. We appreciate this will be an ever-evolving focus for the business to ensure everyone feels supported and has a sense of belonging.