Security Operations Lead & Incident Response Expert

Remote Worker LTD.; Belfast City District; Hybrid; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Health and lifestyle perks

25 days annual leave

Generous pension scheme

Annual performance-based bonus

PA share ownership

Development budget

Job summary

PA Consulting is seeking a Security Operations Manager to lead a SOC/IR team within our Digital Trust & Cyber Security practice in the UK. You will oversee live incident containment, coordinate investigations and help clients mature their security operations, SIEM, SOAR and EDR capabilities.

You'll combine hands‑on leadership with advisory work, working across enterprise and public sector engagements, contributing to stronger cyber resilience while mentoring analysts and shaping incident

Qualifications

• Experience leading or supervising a SOC/CSOC or Incident Response team.
• Practical experience managing live cyber incidents (ransomware, account takeovers, supply chain breaches).
• Hands-on with major SIEM/SOAR tools and EDR/XDR platforms.
• Solid understanding of MITRE ATT&CK, NIST CSF, NCSC CAF v4.0 and ISO 27001.
• Clear communication with engineers and business leaders.

Responsibilities

• Lead and develop SOC analysts and incident responders with clear guidance.
• Coordinate investigations and containment during cyber incidents and lead post‑incident reviews.
• Help clients assess and improve Security Operations capabilities across people, processes and technology.
• Advise on evolving SIEM, SOAR, EDR tooling to strengthen detection and response.
• Develop incident playbooks, runbooks and automated response workflows.

Skills

SOC Leadership

Incident Response

SIEM/SOAR

EDR/XDR

Security Frameworks

Communication

Tools

Microsoft Sentinel

Splunk

Defender for Endpoint

CrowdStrike Falcon

Azure

AWS

GCP

Job description

PA Consulting is seeking a Security Operations Manager to lead a SOC/IR team within our Digital Trust & Cyber Security practice in the UK. You will oversee live incident containment, coordinate investigations and help clients mature their security operations, SIEM, SOAR and EDR capabilities.

You'll combine hands‑on leadership with advisory work, working across enterprise and public sector engagements, contributing to stronger cyber resilience while mentoring analysts and shaping incident