Security Operations Manager

La Fosse; Greater London; Hybrid; GBP 110,000 - 140,000; Full time

Job summary

La Fosse in London is seeking a Security Operations Manager to lead our end-to-end security operations, overseeing the SOC, incident response, detection engineering and threat intelligence. This role combines hands-on technical work with leadership across a global function, operating in a hybrid model with onsite and remote elements. The ideal candidate has led major cyber incident responses and built a SOC or rebuilt one, with strong cloud security expertise across AWS, GCP and Azure.

Qualifications

• Led response to serious cyber incidents.
• Built or rebuilt a SOC: operating model, hiring, tooling, and metrics.
• Technical with strong cloud grounding across AWS, GCP and Azure.
• Built or led detection programmes with rule development, coverage mapping, tuning and automation.
• Experience with threat hunting and purple teaming.

Responsibilities

• Lead end-to-end security operations including SOC and incident response.
• Own detection engineering and threat intelligence programs.
• Lead incident bridges and manage cross-functional response.
• Build and optimise operating model, tooling, and metrics.
• Oversee cloud security across AWS, GCP, and Azure.

Skills

Incident response

SOC leadership

Cloud security

Detection engineering

Threat intelligence

Threat hunting

Purple teaming

Incident bridge

People management

Operational metrics

Job description

Security Operations Manager - London - 4 days onsite 1 day remote

This is a hands-on leadership role. You need to be technical, in the detail, and able to lead an incident bridge. You will run a global function, and own Security Operations end to end: the SOC, incident response, detection engineering and threat intelligence, along with the people and platforms behind them.

• You will need to have personally led the response to serious cyber incidents.
• You will need to have built a SOC: stood one up, or rebuilt one that wasn't working. The operating model, the hiring, the tooling, the metrics.
• Technical, with a solid grounding in cloud. You understand how modern cloud environments (AWS, GCP, Azure) are attacked and defended, including identity, logging, lateral movement and containment, and how incident response works within them.
• You will need to have built or led detection programmes covering rule development, coverage mapping, tuning and automation, and you can review a detection and tell whether it is good.
• Experience with threat hunting and purple teaming.