SOC Manager (Cyber Security Operations)

RONIN Dynamics; Sydney; Hybrid; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Hybrid work

Job summary

RONIN Dynamics in Sydney is seeking a SOC Manager to lead a security operations team and own threat exposure end to end. The role focuses on building an agentic SOC, automating triage with SOAR and AI, and managing vulnerabilities with context-aware detections.

You will report to the CISO, guide a growing team, and drive development with funded training and conference opportunities in a hybrid Sydney setting.

Qualifications

• 5+ years in cyber security operations with team leadership experience.
• Hands-on with cloud-native SecOps platforms and agentic SOC principles.
• Experience moving teams from vulnerability scanning to context-aware CTEM.
• Strong knowledge of SIEM, SOAR, CTI, detection engineering and incident response.

Responsibilities

• Lead a team of security professionals and plan expansion with key hires.
• Drive the agentic SOC roadmap and automate Tier 1/2 triage using SOAR and AI agents.
• Own continuous threat exposure management and enrich alerts with context.

Skills

Leadership

Cloud-native SecOps

CTEM / vulnerability context

SIEM

SOAR

Incident response

Tools

SIEM

SOAR

CTI

Incident Response

Job description

It isn’t a real metric yet. This team wants to make it one.

A large Australian organisation is looking for a SOC Manager to lead its security operations, own threat exposure end to end, and build an agentic SOC. A managed provider handles L1 and L2, so your team can focus on the escalations that matter and the work that stops incidents happening in the first place.

What you’ll be doing

• Leading a team of three, growing to five as you hire a Senior Detection Engineer and a Senior Incident Responder
• Driving the agentic SOC roadmap, automating Tier 1 and Tier 2 triage with SOAR and AI agents to cut MTTR and alert fatigue
• Owning continuous threat exposure management, feeding vulnerability and posture data into the SecOps platform so every alert comes with context
• Building automated playbooks with IT for vulnerability ticketing, ownership and SLA tracking
• Correlating live vulnerabilities with threat actor behaviour, and deploying detections for unpatched systems
• Acting as incident commander when a major incident hits
• Holding the managed provider to strict SLAs as the team moves to an agentic model

What you’ll bring

• 5+ years in cyber security operations, including time leading a SOC or operations team
• Hands‑on experience with cloud-native SecOps platforms and agentic SOC principles
• Experience moving a team from vulnerability scanning to context‑aware CTEM
• Strong working knowledge of SIEM, SOAR, CTI, detection engineering and incident response
• Experience managing a managed security provider
• An ownership mindset: you see a problem and bring a solution

The team

• Flat structure, low egos and a lot of honesty
• People ask for help, share what they know and back each other
• You’ll report to the CISO, who’s openly said the team is smarter than they are
• Real investment in development: a personal plan for every team member, funded training, memberships and conference

The practical bits

• Permanent, full time
• Hybrid, Sydney, 2 days per week onsite in an ideal world

Already automated triage, or built a CTEM program from scratch? I’d love to hear how you did it.