Director, Info Security Operations Centre (SOC)

Brightwater Executive; Leinster; On-site; EUR 160,000 - 190,000; Full time

Job summary

Brightwater Executive is engaging a Director to lead the Dublin-based Cyber Security Operations Centre as it expands its Centre of Excellence in Ireland. The role joins a global, 24/7 follow-the-sun cyber defence model and reports into global information security leadership.

The Director will manage a team across security analysis, threat hunting, insider threat and cyber operations engineering, driving continuous monitoring, incident response and proactive threat detection.

Qualifications

• 10–15+ years in cybersecurity operations or cyber defence.
• 5+ years leading security operations teams.
• Experience with incident response, digital forensics triage and multi-cloud environments.

Responsibilities

• Lead Dublin SOC strategy, priorities and multi-year roadmap.
• Oversee 24/7 operations, capacity planning, shift handovers and budgets.
• Act as Incident Commander for high-severity incidents.
• Coordinate regulatory and client notifications including GDPR, NIS2 and DORA.

Skills

Cybersecurity leadership

Strategic planning

Stakeholder management

People leadership

On-call incident management

Communication with executives

Education

Bachelor's or Master's in CS/Cybersecurity

CISSP or equivalent

Tools

SIEM/SOC tools

EDR/XDR

SOAR

MITRE ATT&CK

Job description

About the Role

Brightwater Executive has been exclusively retained by a leading global financial services institution to appoint a Director to lead its Dublin-based Cyber Security Operations Centre (SOC), as it expands its Centre of Excellence (CoE) in Ireland.

This newly created leadership role offers the opportunity to shape a key hub within the organisation’s global, 24/7 follow-the-sun cyber defence model.

Leading a team of specialists across security analysis, threat hunting, insider threat and cyber operations engineering, the Director will oversee continuous monitoring, incident response and proactive threat detection.

Working closely with global Information Security leadership and teams across Threat Intelligence, Detection Engineering and Technology Risk, the successful candidate will strengthen global cyber resilience, drive operational excellence and ensure effective incident management across international operations.

This role will suit a hands‑on operational leader who combines deep technical expertise with strong people leadership and stakeholder management skills, and is comfortable directing critical incidents, presenting risk metrics to senior executives and engaging with regulators when required.

Key Responsibilities

Security Ops Centre (SOC) Leadership & Operations

• Lead the Dublin SOC, setting strategy, priorities and a multi‑year roadmap aligned with global cyber defence objectives.
• Manage 24/7 operational coverage, capacity planning, shift handovers, escalation procedures, budgets and vendor relationships.
• Ensure seamless coordination with global SOC hubs.

Incident Response & Crisis Management

• Act as Incident Commander for high‑severity cyber incidents, directing containment, investigations and cross‑functional response.
• Brief senior executives and coordinate regulatory and client notifications, including under DORA, NIS2 and GDPR.
• Lead incident simulations, maintain response procedures and oversee sensitive investigations, including insider threat cases.

Detection, Automation & Threat Hunting

• Partner with engineering teams to enhance SIEM/XDR capabilities, improve detection accuracy and expand SOAR automation.
• Integrate threat intelligence, proactive hunting and insider threat monitoring into SOC operations.
• Measure and improve detection coverage against the MITRE ATT&CK framework.

People Leadership & Performance

• Develop, mentor and retain a multidisciplinary team, building career pathways and succession plans.
• Define and report key performance metrics, including MTTD, MTTR, detection coverage and automation rates.
• Support audit, risk and control reviews and broader operational resilience objectives.

Experience Required

• 10–15+ years’ experience in cybersecurity operations, threat detection, incident response or cyber defence, ideally within financial services or another large, regulated organisation.
• 5+ years leading security operations or engineering teams, preferably in a multi-tiered or global follow‑the‑sun environment.
• Strong expertise in incident response, digital forensics triage, containment and enterprise or multi‑cloud environments (AWS, Azure or GCP).
• Deep knowledge of threat actor techniques, insider threats and the MITRE ATT&CK framework.
• Practical experience with SIEM, EDR/XDR, SOAR and network detection technologies.
• Proven ability to build and develop high‑performing technical teams.
• Excellent communication and stakeholder management skills, including engagement with executives and regulators during critical incidents.
• Flexibility to provide out‑of‑hours on‑call support for major incidents.
• A degree in Computer Science, Cybersecurity or another STEM discipline, or equivalent experience.
• Relevant certifications such as CISSP, CISM, GCIH, GCFA or GNFA.
• Budget ownership and experience managing external service providers.
• Ideally experience with DORA, NIS2, GDPR and Irish or EU financial regulatory requirements.
• Ideally experience building or maturing a SOC, including automation and AI‑assisted triage.

Why Consider This Opportunity?

• Play a pivotal role in establishing a strategic hub within a global cyber defence network.
• Lead a mission‑critical function protecting financial accounts and global infrastructure.
• Own and shape Dublin’s capabilities across incident response, threat hunting, insider threat and detection engineering.
• Build a high-performing team with a strong focus on technical maturity and professional development.
• Competitive remuneration and benefits package.

Brightwater Executive is exclusively retained for Director, Info Security Operations Centre (SOC) appointment.