SOC Manager

Creation Recruitment; Reading; Hybrid; GBP 85,000 - 100,000; Full time

Benefits offered by this job

Benefits package

Job summary

Creation Recruitment is seeking an experienced SOC Manager / Senior Security Analyst for a fully remote or hybrid role based around Reading. The position combines hands-on Tier 2/3 investigations with incident leadership, detection engineering and team development, within a modern SOC operating model.

The role focuses on industry-standard frameworks, threat intelligence, and secure operations for clients in aviation and beyond, with a strong emphasis on operational continuity and rigorous

Qualifications

• Experience in security operations centers and blue-team activities.
• Hands-on Tier 2/3 incident investigations and escalation leadership.
• Familiarity with forensics, incident response, and threat monitoring.

Responsibilities

• Shape and mature the SOC operating model.
• Lead Tier 2/3 investigations and incident response.
• Act as incident commander during active security events.
• Tune SIEM rules to reduce alert noise and improve coverage.
• Develop detection rules, playbooks and escalation processes.
• Incorporate threat intelligence and adversary TTPs.
• Support forensics, breach monitoring and pen-testing activities.
• Establish follow-the-sun workflows and smooth handovers.
• Mentor junior analysts to raise investigation capabilities.
• Identify and close monitoring blind spots.

Skills

SOC operations

Incident response

Digital forensics

Threat hunting

Mentoring analysts

Distributed environments

Tools

SIEM platforms

Detection engineering

Job description

Fully remote or Hybrid working ( Reading)

Permanent salary - £85,000-£100,000 plus benefits.

We’re looking for an experienced SOC Manager / Senior Security Analyst who can combine hands-on Tier 2/3 investigation with incident leadership, detection engineering and team development.

This is not a purely managerial SOC role. You’ll remain close to the technology, acting as the senior escalation point for complex incidents while helping shape how the SOC operates from the ground up.

Our first major engagement is within business aviation, where security monitoring must be rigorous without disrupting operational continuity.

What you’ll do

• Help shape the operating model for the growing SOC capability
• Lead Tier 2/3 investigations and incident response
• Act as incident commander during active security events
• Tune SIEM detection logic and reduce alert noise
• Develop detection rules, playbooks and escalation processes
• Integrate threat intelligence and emerging adversary TTPs
• Support digital forensics, breach monitoring and penetration-testing activity
• Build effective follow-the-sun workflows and handovers
• Mentor Tier 1/2 analysts and develop their investigation capability
• Identify monitoring blind spots and improve security coverage

What we’re looking for

• SOC / blue-team security operations
• Tier 2 or Tier 3 security analysis
• Digital forensics and incident investigation
• Incident response and incident command
• SIEM platforms and detection engineering
• MITRE ATT&CK, NIST and CIS frameworks
• Threat intelligence and threat hunting
• Leading or mentoring analysts
• Working in distributed or operationally constrained environments

The kind of person who will thrive here

You’re technically curious, pragmatic and comfortable operating with autonomy.

You understand that frameworks are a starting point rather than a prescription, and you can balance strong security controls with the realities of operational environments.

You use AI-supported tools intelligently, but you don’t outsource your judgement to them.

You document well, communicate clearly across shifts and enjoy helping less experienced analysts become stronger investigators.

This is an opportunity to help build a SOC rather than simply inherit one.

You’ll work on technically challenging problems, influence the operating model from the outset and play a central role in developing a resilient security capability for clients where the quality of security operations genuinely matters.