Director, Info Security Operations Centre (SOC)

Brightwater Executive; Leinster; On-site; EUR 180,000 - 250,000; Full time

Job summary

Brightwater Executive invites a senior cybersecurity leader to head its Dublin-based Security Operations Centre, expanding a global 24/7 defence network. You will oversee a team of specialists across security analysis, threat hunting, insider threat and operations engineering, steering continuous monitoring and incident response.

You will report to Information Security leadership, collaborate with Threat Intelligence and Technology Risk, and drive operational resilience while engaging regulators

Qualifications

• 10-15+ years in cybersecurity operations, threat detection or cyber defence within financial services or regulated environments.
• 5+ years leading security operations or engineering teams in multi-site or follow-the-sun setups.
• Hands-on expertise in incident response, forensics triage, containment and cloud environments (AWS/Azure/GCP).
• Strong knowledge of MITRE ATT&CK, threat actors and insider threats.
• Proven ability to build high-performing technical teams and manage budgets with external providers.

Responsibilities

• Lead the Dublin SOC, set strategy, priorities and a long-term roadmap aligned with global cyber defence objectives.
• Ensure 24/7 coverage, capacity planning, handovers, escalation processes, budgets and vendor management.
• Act as Incident Commander for high-severity incidents and coordinate regulatory/client notifications.
• Drive detection, automation and threat hunting with SIEM/XDR and SOAR across global hubs.
• Define and report KPIs (MTTD/MTTR, detection coverage, automation rates) and support audits/regulatory reviews.
• Mentor, develop and retain a multidisciplinary team and manage relationships with executives and regulators.

Skills

Cybersecurity leadership

Incident response

Threat hunting

SIEM/XDR

MITRE ATT&CK

Regulatory engagement

Budget ownership

People management

Follow-the-sun operations

Cloud environments (multi-cloud)

Education

Degree in Computer Science/Cybersecurity

Security certifications (CISSP/CISM/GCIH/GCFA/GNFA)

Tools

SIEM

EDR/XDR

SOAR

Threat intelligence

Job description

Brightwater Executive has been exclusively retained by a leading global financial services institution to appoint a Director to lead its Dublin-based Cyber Security Operations Centre (SOC), as it expands its Centre of Excellence (CoE) in Ireland.

This newly created leadership role offers the opportunity to shape a key hub within the organisation’s global, 24/7 follow-the-sun cyber defence model.

Leading a team of specialists across security analysis, threat hunting, insider threat and cyber operations engineering, the Director will oversee continuous monitoring, incident response and proactive threat detection.

Working closely with global Information Security leadership and teams across Threat Intelligence, Detection Engineering and Technology Risk, the successful candidate will strengthen global cyber resilience, drive operational excellence and ensure effective incident management across international operations.

This role will suit a hands-on operational leader who combines deep technical expertise with strong people leadership and stakeholder management skills, and is comfortable directing critical incidents, presenting risk metrics to senior executives and engaging with regulators when required.

Key Responsibilities

Security Ops Centre (SOC) Leadership & Operations

• Lead the Dublin SOC, setting strategy, priorities and a multi-year roadmap aligned with global cyber defence objectives.
• Manage 24/7 operational coverage, capacity planning, shift handovers, escalation procedures, budgets and vendor relationships.
• Ensure seamless coordination with global SOC hubs.

Incident Response & Crisis Management

• Act as Incident Commander for high-severity cyber incidents, directing containment, investigations and cross-functional response.
• Brief senior executives and coordinate regulatory and client notifications, including under DORA, NIS2 and GDPR.
• Lead incident simulations, maintain response procedures and oversee sensitive investigations, including insider threat cases.

Detection, Automation & Threat Hunting

• Partner with engineering teams to enhance SIEM/XDR capabilities, improve detection accuracy and expand SOAR automation.
• Integrate threat intelligence, proactive hunting and insider threat monitoring into SOC operations.
• Measure and improve detection coverage against the MITRE ATT&CK framework.
• Develop, mentor and retain a multidisciplinary team, building career pathways and succession plans.
• Define and report key performance metrics, including MTTD, MTTR, detection coverage and automation rates.
• Support audit, risk and control reviews and broader operational resilience objectives.

Experience Required

• 10-15+ years' experience in cybersecurity operations, threat detection, incident response or cyber defence, ideally within financial services or another large, regulated organisation.
• 5+ years leading security operations or engineering teams, preferably in a multi-tiered or global follow-the-sun environment.
• Strong expertise in incident response, digital forensics triage, containment and enterprise or multi-cloud environments (AWS, Azure or GCP).
• Deep knowledge of threat actor techniques, insider threats and the MITRE ATT&CK framework.
• Practical experience with SIEM, EDR/XDR, SOAR and network detection technologies.
• Proven ability to build and develop high-performing technical teams.
• Excellent communication and stakeholder management skills, including engagement with executives and regulators during critical incidents.
• Flexibility to provide out-of-hours on-call support for major incidents.
• A degree in Computer Science, Cybersecurity or another STEM discipline, or equivalent experience.
• Relevant certifications such as CISSP, CISM, GCIH, GCFA or GNFA.
• Budget ownership and experience managing external service providers.
• Ideally experience with DORA, NIS2, GDPR and Irish or EU financial regulatory requirements.
• Ideally experience building or maturing a SOC, including automation and AI-assisted triage.

Why Consider This Opportunity?

• Play a pivotal role in establishing a strategic hub within a global cyber defence network.
• Lead a mission-critical function protecting financial accounts and global infrastructure.
• Own and shape Dublin’s capabilities across incident response, threat hunting, insider threat and detection engineering.
• Build a high-performing team with a strong focus on technical maturity and professional development.
• Competitive remuneration and benefits package.

Brightwater Executive is exclusively retained for Director, Info Security Operations Centre (SOC) appointment.