SOC Manager - IN

Rackspace Technology

Gurugram District

On-site

INR 2,800,000 - 4,200,000

Full time

4 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Rackspace Technology in Gurugram is seeking an experienced Security Operations Manager to lead the 24x7 managed security services. You will supervise security analysts and engineers, coordinate incident investigations, and drive continuous improvements across the cyber defense portfolio.

The role emphasizes hands-on leadership, strong customer engagement with CISOs, and delivering against SLAs, KPIs, and evolving threat landscapes across multi-cloud environments.

Qualifications

10–15 years of cybersecurity experience with leadership in SOC or security operations.
Proven ability to run 24x7 security operations in MSSP or enterprise SOC settings.
Hands-on experience in incident investigation, threat detection and response.
Practical expertise in SIEM platforms, preferably Microsoft Sentinel or Elastic Security.
Strong customer communication and ability to mentor engineers.
Knowledge of cloud security across major providers and vulnerability management.

Responsibilities

Lead a multidisciplinary SOC team across L1–L3 functions and ensure 24x7 security operations.
Direct security investigations, incident containment, remediation guidance and recovery validation.
Oversee MSSP service delivery, detection engineering and automation initiatives.
Engage with customers’ CISOs, conduct security workshops and manage escalations.
Develop and maintain runbooks, playbooks and governance for continuous improvement.
Drive vulnerability management, risk prioritization and remediation coordination.
Collaborate across infrastructure, cloud, IAM and application teams for incident resolution.

Skills

SOC leadership

Incident investigation

Threat detection

Security operations management

Customer engagement

Mentoring engineers

Education

Bachelor's degree in Computer Science or related field

Tools

Microsoft Sentinel

Elastic Security

CrowdStrike Falcon

Microsoft Defender for Endpoint

Qualys

Palo Alto Networks

Fortinet

Cloudflare WAF

Job description

Job Description:

About Rackspace Cyber Defence

Rackspace Cyber Defence is our next generation cyber defence and security operations capability that builds on 20+ years of securing customer environments to deliver proactive, risk-based, threat-informed and intelligence driven security services.

Our purpose is to enable our customers to defend against the evolving threat landscape across on-premises, private cloud, public cloud and multi-cloud workloads.

Our goal is to go beyond traditional security controls to deliver cloud-native, DevOps-centric and fully integrated 24x7x365 cyber defence capabilities that deliver a proactive, threat-informed, risk-based, intelligence-driven approach to detecting and responding to threats.

Our mission is to help our customers:

Proactively detect and respond to cyber-attacks – 24x7x365.
Defend against new and emerging risks that impact their business.
Reduce their attack surface across private cloud, hybrid cloud, public cloud, and multi-cloud environments.
Reduce their exposure to risks that impact their identity and brand.
Develop operational resilience.
Maintain compliance with legal, regulatory and compliance obligations.

What we’re looking for

To support our continued success and deliver a Fanatical Experience™ to our customers, Rackspace Technology is seeking an experienced, technically proficient and customer-focused Security Operations Manager to lead the delivery of its 24×7 Managed Security Services.

The successful candidate will lead a multidisciplinary team of security analysts and engineers responsible for threat detection, incident investigation, incident response, vulnerability management and security operations across customer environments.

This is a hands-on technical leadership role, requiring strong incident investigation capabilities, excellent customer engagement skills and proven experience managing security operations in an MSSP or enterprise SOC environment.

The Security Manager will be responsible for maintaining operational excellence, developing technical capabilities, mentoring engineers and driving continuous improvements across Rackspace's Cyber Defense portfolio.

Key Accountabilities

1. SOC Leadership & Team Management

Lead, manage and mentor a team of SOC analysts, security engineers and technical specialists across L1/L2/L3 functions.
Oversee 24×7 security operations, shift coverage, workload distribution, incident escalation and operational readiness.
Provide technical direction and guidance during complex investigations and security incidents.
Conduct technical reviews, knowledge-sharing sessions, coaching and skills development.
Drive analyst productivity, operational quality and team performance.
Maintain effective collaboration across security service towers.

2. Security Incident Investigation & Response

Lead technical investigations into critical and high-severity security incidents, including malware, ransomware, compromised identities, unauthorized access, suspicious network activity and cloud security threats.
Act as the security incident lead for P1/P2 incidents, coordinating investigation, containment, remediation guidance and security recovery validation.
Perform or oversee advanced analysis of endpoint telemetry, security logs, network events, indicators of compromise and attacker techniques.
Guide analysts in threat hunting, incident correlation, root cause analysis and forensic evidence preservation.
Coordinate with infrastructure, network, cloud, IAM, application and customer security teams to facilitate incident resolution.
Ensure timely customer communication, incident updates, escalations and post-incident reporting.
Maintain and improve incident response playbooks and investigation procedures.

3. Managed Security Services & Technology Ownership

Oversee security operations across Rackspace's RCDC portfolio, including:

XDR / SIEM: Microsoft Sentinel, Elastic Security and associated detection, investigation, correlation and response workflows.
EDR: CrowdStrike Falcon and Microsoft Defender for Endpoint, including threat investigation, containment, policy tuning and agent health.
VMDR: Qualys vulnerability management, assessment coverage, vulnerability prioritization, reporting and remediation coordination.
Edge Security: Cloudflare WAF, DDoS protection and associated security monitoring and response.
Managed Network Security: Palo Alto Networks, Fortinet and native cloud security controls, including security incident coordination and policy management.
MDRM / External Threat Monitoring: CloudSEK and related external exposure and threat intelligence capabilities.
Cloud Security: CSPM/CNAPP technologies such as Prowler and Upwind, as applicable to the evolving service portfolio.

The role requires strong working knowledge of core SOC technologies and the ability to lead specialists across the broader portfolio. Deep hands‑on expertise in every individual product is not expected.

4. Customer Engagement & Service Delivery

Serve as a senior technical point of contact for customer CISOs, security leaders and technical stakeholders.
Lead technical incident discussions, operational reviews, security workshops and customer escalations.
Explain security incidents, risks, investigation findings and remediation recommendations to technical and non-technical audiences.
Ensure delivery against agreed SLAs, KPIs, customer commitments and security service objectives.
Oversee customer onboarding, monitoring coverage, policy configuration and operational handover.
Identify recurring customer issues and recommend improvements to security controls, detections and operational processes.
Build trusted customer relationships through proactive communication and technical credibility.

5. Detection Engineering, Threat Intelligence & Automation

Oversee detection rule development, tuning, alert correlation and false-positive reduction.
Promote proactive threat hunting using MITRE ATT&CK, threat intelligence and adversary TTPs.
Develop and improve security investigation and response runbooks.
Identify opportunities for SOAR automation, AI-assisted investigation and pre-approved response actions.
Improve SOC effectiveness through measurable reductions in alert noise, investigation effort and response delays.
Ensure security automation follows appropriate authorization, testing, logging and change‑control procedures.

6. Vulnerability & Exposure Management

Oversee vulnerability assessment operations, scanning coverage and agent health monitoring.
Ensure critical vulnerabilities are appropriately prioritized, communicated and tracked.
Coordinate remediation activities with infrastructure, cloud, application and customer teams.
Monitor vulnerability aging, overdue findings, risk exceptions and remediation validation.
Support customers in understanding and reducing security exposure.

7. Governance, Reporting & Continuous Improvement

Maintain SOC operational standards, investigation quality, documentation and service delivery controls.
Track operational KPIs such as incident response compliance, investigation quality, monitoring coverage, customer escalations and service improvement.
Lead security incident reviews, root cause analysis and corrective action planning.
Maintain operational runbooks, escalation procedures and knowledge documentation.
Support service enhancements, technology integrations and operational readiness for new security offerings.

Skills & Experience

10–15 years of cybersecurity experience, including approximately 4–6 years in SOC leadership, incident response or security operations management.
Proven experience managing a 24×7 SOC or MSSP security operations environment.
Strong hands‑on experience in security incident investigation, threat detection, incident response and log analysis.
Practical expertise in at least one major SIEM platform, preferably Microsoft Sentinel or Elastic Security.
Strong experience with enterprise EDR technologies such as CrowdStrike Falcon or Microsoft Defender for Endpoint.
Working knowledge of vulnerability management platforms, preferably Qualys.
Understanding of cloud security across Azure, AWS and GCP.
Knowledge of network security, firewalls, WAF, identity security and endpoint protection.
Experience with MITRE ATT&CK, NIST incident response guidance and security operations best practices.
Strong analytical, troubleshooting and problem‑solving capabilities.
Excellent customer communication, stakeholder management and presentation skills.
Experience handling major security incidents and coordinating multidisciplinary technical teams.
Demonstrated ability to mentor engineers and develop high‑performing technical teams.

Preferred Qualifications

Experience working in an MSSP or managed security services organization supporting multiple enterprise customers.
Exposure to Cloudflare, Palo Alto Networks, Fortinet, CloudSEK, CSPM or CNAPP technologies.
Experience with SOAR platforms, security automation, scripting and AI‑assisted SOC operations.
Experience supporting customer technical workshops, solution evaluations and new service onboarding.
Familiarity with ITIL incident, problem and change management processes.
Relevant certifications such as CISSP, CISM, GCIH, GCIA, GSOC, SC‑200, or equivalent practical expertise.
Bachelor's degree in Computer Science, Information Security, Engineering or a related discipline, or equivalent professional experience.

Soft skills

Strong technical leadership with a willingness to engage directly in complex security investigations.
Customer‑focused, accountable and decisive during high‑pressure situations.
Capable of balancing operational management with hands‑on technical oversight.
Effective communicator with senior customer stakeholders and internal technical teams.
Collaborative leader who develops talent and encourages continuous learning. Proactive, adaptable and committed to improving security operations.

About Rackspace Technology

Rackspace Technology is the trusted operator of the full enterprise AI stack, from governed private cloud to AI inference and agents in production. From edge to core to cloud, we operate the infrastructure, data layer, and software integration to deliver business outcomes with the predictable cost, reliability, security, and compliance that regulated and mission‑critical environments demand. We support customers in more than 120 countries with AI capabilities spanning private cloud, public cloud, applications, data and cyber resilience.