Security Operations Manager

La Fosse; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

La Fosse in London is seeking a Security Operations Manager to lead end-to-end security operations, including the SOC, incident response, detection engineering, and threat intelligence. The role requires a hands-on, technical leader who can manage incident bridges and drive a global security program.

You will own the operating model, tooling, metrics, and people behind security operations, with proven experience in building or rebuilding SOCs and strong cloud security across AWS, GCP, and Azure.

Qualifications

• Led the response to serious cyber incidents.
• Built or rebuilt SOC—operating model, staffing, tooling, metrics.
• Strong cloud security background across AWS, GCP, and Azure.
• Led detection programmes: rule development, coverage mapping, tuning, automation.
• Experience with threat hunting and purple teaming.

Responsibilities

• Oversee the global Security Operations function end-to-end, including SOC, IR, detection, and threat intel.
• Lead the incident bridge and coordinate cross-team response during major cyber incidents.
• Define operating model, staffing, tooling, and metrics for security operations.
• Drive hiring, training, and career development within the SOC.
• Continuously improve detection coverage and incident response processes across cloud environments.

Skills

Leadership

Incident response

SOC management

Threat intelligence

Detection engineering

Cloud security

IAM / Logging

Purple teaming

Threat hunting

Tools

AWS

GCP

Azure

Job description

Security Operations Manager - London - 4 days onsite 1 day remote

This is a hands-on leadership role. You need to be technical, in the detail, and able to lead an incident bridge. You will run a global function, and own Security Operations end to end: the SOC, incident response, detection engineering and threat intelligence, along with the people and platforms behind them.

• You will need to have personally led the response to serious cyber incidents.
• You will need to have built a SOC: stood one up, or rebuilt one that wasn't working. The operating model, the hiring, the tooling, the metrics.
• Technical, with a solid grounding in cloud. You understand how modern cloud environments (AWS, GCP, Azure) are attacked and defended, including identity, logging, lateral movement and containment, and how incident response works within them.
• You will need to have built or led detection programmes covering rule development, coverage mapping, tuning and automation, and you can review a detection and tell whether it is good.
• Experience with threat hunting and purple teaming.