SOC Lead

SecurityHQ; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

SecurityHQ in London is seeking an experienced SOC Lead to head our UK Security Operations Centre and protect clients against evolving threats. You will own DFIR investigations, guide a high-performing team and partner with technical and client stakeholders to deliver secure outcomes.

You will manage 24/7 SOC operations, drive process improvements, mentor staff and ensure high-quality incident response across engagements in a fast-paced cyber security business.

Qualifications

• Proven experience leading a Security Operations Centre team.
• Strong DFIR background with complex incident handling.
• Experience with SIEM/EDR technologies and client-facing communication.

Responsibilities

• Lead, mentor and develop a team of Security Analysts and Incident Responders.
• Oversee SOC operations, including shift planning and resource management within a 24/7 environment.
• Act as the primary escalation point for complex security incidents.
• Lead end-to-end Digital Forensics & Incident Response investigations, from initial response through to remediation and reporting.
• Present security findings, incident reports and recommendations to clients and stakeholders.
• Drive continuous improvement across SOC processes, playbooks, tooling and operational effectiveness.
• Support threat hunting, threat intelligence integration and ongoing SOC maturity initiatives.

Skills

Leadership

DFIR

SOC Management

Security Operations

Threat Detection

Incident Response

Communication

Stakeholder Management

Mentoring

Decision Making

Tools

Microsoft Sentinel

IBM QRadar

Datadog

Darktrace

CrowdStrike Falcon

SentinelOne

Microsoft Defender

Job description

We're looking for an experienced SOC Lead to lead our UK Security Operations Centre and play a key role in protecting our clients from an evolving threat landscape. This is a leadership position for someone who enjoys developing people, improving processes, and taking ownership of complex cyber security investigations.

As the senior escalation point within the SOC, you will lead Digital Forensics & Incident Response (DFIR) activities, oversee day-to-day operations, and ensure the delivery of high-quality security services to our clients. You'll work closely with both technical teams and customer stakeholders, helping drive operational excellence while supporting the growth and development of the SOC function.

This role would suit an experienced SOC professional who combines strong technical expertise with excellent leadership and communication skills. You'll be comfortable making decisions under pressure, managing priorities across a 24/7 environment, and supporting a high-performing team in a fast-paced cyber security business.

This role is hybrid, with three days per week in our Blackfriars office.

About SecurityHQ

SecurityHQ is a global cybersecurity company. Our specialist teams design, engineer and manage solutions that do three things: Promote clarity and trust in a complex world. Build momentum around improving security posture. And increase the value of cybersecurity investment within organizations. Free from limitations, and inclusive of all requirements, we focus on defending today, while mitigating the risks of tomorrow. And into the future. Our solutions are tailored to our customers and their unique context. Around the clock, 365 days per year, our customers are never alone.

SecurityHQ – We’re focused on engineering cybersecurity, by design.

Responsibilities

• Lead, mentor and develop a team of Security Analysts and Incident Responders
• Conduct regular performance reviews, coaching sessions and career development discussions
• Act as the primary escalation point for complex security incidents and investigations
• Lead end-to-end Digital Forensics & Incident Response investigations, from initial response through to remediation and reporting
• Oversee SOC operations, including shift planning and resource management within a 24/7 environment
• Review investigations, alerts and case documentation to ensure high quality standards are maintained
• Present security findings, incident reports and recommendations to clients and stakeholders
• Build trusted relationships with clients and act as a key point of contact for security operations matters
• Drive continuous improvement across SOC processes, playbooks, tooling and operational effectiveness
• Support threat hunting, threat intelligence integration and ongoing SOC maturity initiatives

What We Are Looking For

• Proven experience leading or managing a Security Operations Centre team
• Strong background in Digital Forensics & Incident Response (DFIR)
• Experience handling complex cyber security incidents, investigations and breach response activities
• Strong understanding of security operations, threat detection and incident response best practices
• Experience working with SIEM technologies such as Microsoft Sentinel, IBM QRadar, Datadog or Darktrace
• Hands-on experience with EDR platforms including CrowdStrike Falcon, SentinelOne and Microsoft Defender
• Strong knowledge of threat hunting, log analysis and attacker methodologies
• Excellent communication skills with the ability to engage both technical and non-technical stakeholders
• Experience presenting findings, recommendations and security updates to clients or senior leadership teams
• Additional certifications such as CISSP, GPEN or CEH would be advantageous
• Knowledge of cloud environments including AWS, Azure or GCP would be beneficial
• A proactive leadership style and a passion for developing high-performing cyber security teams