Security Operations Center Manager

Spot Your Leaders & Consulting; Bengaluru; On-site; INR 3,000,000 - 5,500,000; Full time

Job summary

Spot Your Leaders & Consulting is seeking an experienced SOC Associate Manager in Bengaluru to lead day-to-day SOC operations, supervise security analysts and team leads, and ensure monitoring, detection, investigation, containment, and response to cyber incidents.

You will drive AI security, threat detection, and cloud security across endpoints, identity, networks, and data, while coordinating with clients and internal teams to deliver measurable security outcomes and maintain service quality.

Responsibilities

• Lead daily SOC operations, shift governance, workload allocation, alert triage, incident investigation, escalation, and closure.
• Provide management oversight for high-severity and major incidents, ensuring containment, eradication, recovery, communication, and post-incident review.
• Act as escalation point for complex incidents (ransomware, data exfiltration, cloud attacks, APTs).
• Ensure compliance with incident response playbooks, procedures, SLAs, and regulatory/contractual obligations.
• Drive root-cause analysis and track corrective and preventive actions to closure.
• Maintain readiness for crisis response, on-call support, and major incident coordination.

Job description

The SOC Associate Manager is responsible for leading day-to-day Security Operations Centre activities, managing a team of security analysts and team leaders, and ensuring effective monitoring, detection, investigation, containment, and response to cyber security incidents. The role combines operational leadership, technical oversight, service governance, and continuous improvement across enterprise SOC capabilities. The position provides management oversight for major incidents, drives SOC automation and detection maturity, and ensures security monitoring coverage across endpoint, identity, cloud, network, application, email, data, and AI enabled environments. The role collaborates closely with clients, customers, vendors, technology teams, risk functions, and senior leadership to deliver measurable security outcomes and maintain service quality.

Key Responsibilities

SOC Operations & Incident Management

• Lead daily SOC operations, shift governance, workload allocation, alert triage, incident investigation, escalation, and closure.
• Provide management oversight for high-severity and major cyber security incidents, ensuring timely containment, eradication, recovery, communication, and post incident review.
• Act as the escalation point for complex incidents involving ransomware, malware, insider threats, data exfiltration, account compromise, cloud attacks, network intrusions, and advanced persistent threats.
• Ensure compliance with incident response playbooks, standard operating procedures, service-level commitments, and regulatory or contractual obligations.
• Drive root-cause analysis and track corrective and preventive actions through closure.
• Maintain operational readiness for crisis response, on-call support, and major incident coordination.

Leadership, People Management & Team Development

• Lead, coach, and develop SOC analysts, senior analysts, technical leads, and team leaders across shifts and specialised functions.
• Set team objectives, define responsibilities, monitor delivery, and provide regular developmental feedback aligned to role expectations.
• Plan staffing, shift coverage, leave, on-call rosters, succession, cross-training, and skill development to sustain 24x7 operations.
• Build a high-performance culture focused on accountability, collaboration, customer service, technical excellence, and continuous learning.
• Conduct knowledge-sharing sessions, incident reviews, tabletop exercises, and capability assessments.
• Support recruitment, technical interviews, onboarding, performance enablement, retention, and workforce planning.

Threat Detection, Hunting & Engineering

• Oversee development, tuning, validation, and lifecycle management of SIEM correlation rules, analytics, dashboards, and detection use cases.
• Drive proactive threat hunting using threat intelligence, behavioural analytics, MITRE ATT&CK, and hypothesis-based techniques.
• Ensure detection coverage across endpoint, network, identity, cloud, application, email, data, and AI security telemetry.
• Reduce false positives, improve alert fidelity, and establish measurable detection effectiveness and coverage metrics.
• Coordinate with SOAR and engineering teams to automate enrichment, triage, containment, notification, ticketing, and evidence collection workflows.

AI Security

• Oversee monitoring and response for AI and generative AI security risks, including unauthorised AI usage, sensitive data exposure, prompt injection, model abuse, insecure integrations, identity misuse, and anomalous AI service activity.
• Collaborate with AI governance, data protection, cloud, application security, privacy, and risk teams to define monitoring requirements and incident response procedures for AI-enabled solutions.
• Promote secure adoption of AI within SOC operations through governed use of AI-assisted investigation, summarisation, detection engineering, threat intelligence, and automation.
• Validate that AI-enabled security tools maintain appropriate human oversight, auditability, access control, data handling, and evidence retention.
• Track emerging AI-related threats and translate relevant risks into detection, hunting, response, and awareness use cases.
• Provide SOC oversight for security monitoring across Azure, AWS, Microsoft 365, SaaS, container, and hybrid cloud environments.
• Ensure effective ingestion and correlation of cloud control-plane, identity, workload, network, application, storage, and security platform telemetry.
• Coordinate investigations involving cloud account compromise, privilege escalation, exposed services, misconfiguration, malicious workloads, data access anomalies, and cloud-native attacks.
• Collaborate with cloud engineering, architecture, DevSecOps, application security, and platform teams to improve preventive and detective controls.
• Drive operational use of CSPM, CWPP, CNAPP, CASB, cloud-native security, and identity protection capabilities within SOC workflows.

Network Security

• Oversee monitoring and investigation using firewall, IDS/IPS, NDR, proxy, DNS, VPN, WAF, email gateway, secure web gateway, and network flow telemetry.
• Lead response to network intrusion, command-and-control, lateral movement, data exfiltration, scanning, denial-of-service, malicious domain, and suspicious IP activity.
• Work with network and infrastructure teams on segmentation, access control, perimeter protection, remote access security, and remediation of identified weaknesses.
• Ensure visibility across on-premises, cloud, branch, remote-access, and third-party network connections.
• Support validation of external attack surface and threat intelligence findings related to organisational IP addresses and domains.
• Act as a primary operational contact for clients and customers on SOC services, incidents, risks, service reviews, improvement plans, and security reporting.
• Lead governance meetings, operational reviews, incident briefings, and executive updates with clear articulation of impact, actions, ownership, and residual risk.
• Collaborate with vendors and managed service partners for product support, escalations, service improvement, roadmap alignment, and issue resolution.
• Participate in customer workshops, audits, assessments, proposals, transitions, and presentations as the SOC subject matter representative.
• Manage stakeholder expectations and maintain strong working relationships across business, technology, security, legal, privacy, compliance, and risk teams.
• Define and monitor SOC KPIs, KRIs, SLAs, operational health metrics, detection coverage, case quality, backlog, response performance, and automation benefits.
• Prepare management dashboards, customer reports, incident summaries, trend analysis, and risk-based recommendations.
• Maintain and improve SOC processes, runbooks, playbooks, escalation matrices, knowledge articles, and governance documentation.
• Lead SOC maturity assessments, control validation, purple-team exercises, audit support, lessons learned, and continual service improvement initiatives.
• Identify opportunities for platform consolidation,