Security Operations Center (SOC) Manager / Lead

Hong Leong Bank; Malaysia; On-site; MYR 180,000 - 300,000; Full time

Job summary

Hong Leong Bank is seeking a SOC Manager / Lead to direct day-to-day security operations, triage, and detection engineering. You will oversee an internal Tier 2 security team and coordinate with an external MSSP to ensure SLA compliance and effective incident response.

You will curate and display real-time SOC dashboards, monitor tooling health, and maintain playbooks tailored to banking threats. This role demands strong leadership and deep security operations expertise.

Qualifications

• 3+ years in banking/fintech with incident escalation.
• 3+ years leading technical security teams.
• Experience building real-time SOC dashboards and wallboards.
• Experience managing external Tier 1 MSSP SLA and tuning alerts.
• Experience Tier 2 triage with incident responders on high-severity incidents.
• CISSP or GIAC certifications preferred.

Responsibilities

• Direct day-to-day security operations, technical triage, and detection engineering in the SOC.
• Oversee internal SOC L2 analysts and MSSP coordination to ensure SLA compliance.
• Maintain and display daily SOC wallboard statistics, tooling health, and alert metrics (MTTA, MTTD, MTTR).
• Lead containment measures during active intrusions (host isolation, NAC actions, identity suspension).
• Escalate cyber incidents to incident responders and support containment actions.
• Maintain SOC playbooks tailored to banking threat vectors and govern service delivery with MSSP reviews.

Skills

Security leadership

SOC monitoring dashboards

Incident escalation

Vendor management

Communication

Tools

SIEM

EDR

NAC

MSSP

Job description

**If you are looking to excel and make a difference, take a closer look at us...****Overview:**The SOC Manager / Lead directs day-to-day security operations, technical triage, and detection engineering related activities in the SOC. This role oversees an internal team of Tier 2 (L2) security analysts and detection/security engineers, while managing the operational delivery and SLA compliance of an outsourced Managed Security Service Provider (MSSP) Tier 1 (L1) monitoring. This position also owns the real-time operational visibility of the floor, including curating, maintaining, and displaying daily SOC dashboard and wallboard statistics (covering tooling health, log pipeline status, alert backlogs, and operational metrics). During high-severity security events, the role escalates directly to designated organizational Incident Response personnel with technical analysis and operational support, and supports containment activities.**Responsibilities**: * Conduct daily stand-ups using wallboard metrics to identify blind spots, ingestion drops, or anomalous spikes in alert trends.* Operational Visibility & Daily Health Monitoring: Curate and maintain the central SOC operational wallboard / dashboard display, ensuring high-availability, accurate real-time telemetry, and clear visualization of floor operations. Track and display daily security health metrics, including: Pipeline & Tooling Health, Operational Queue Status, Key Performance Metrics: Daily Mean Time to Acknowledge (MTTA), Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR).* Oversee activity of internal SOC L2 analysts in investigating, validating, and containing escalated security alerts received from the MSSP.* Oversee rapid technical containment measures (host isolation via EDR, port/VLAN quarantine via NAC, identity suspension) during active intrusion attempts.* Serve as the primary technical bridge to incident responder personnel, formally escalating cyber incidents from SOC and supporting block or containment action.* Maintain and test response SOC playbooks customized for banking-specific threat vectors.* Govern daily service delivery, SLA adherence, and escalation handoffs from the Tier 1 MSSP. Lead operational reviews with MSSP counterparts to evaluate detection efficacy against evolving threats targeting the financial services sector.* Security Engineering & Tooling Oversight. Direct the security engineering sub-team responsible for data onboarding, detection rules, and infrastructure health across the stack of SIEM, EDR, Email/Phishing controls and Network Access Control (NAC):* Partner with security engineers to develop automated enrichment and containment workflows connecting SIEM, NAC, and EDR platforms.**Skills & Experience We Are Looking For:** * Banking / Financial Services: 3+ years in a banking, fintech, or strictly regulated financial enterprise with defined incident escalation tiers and compliance mandates.* Operational Leadership: 3+ years leading technical teams (security analysts and engineers), driving daily shift operations, and mentoring personnel.* SOC Dashboards & Metrics: Hands-on experience building and operationalizing real-time SOC monitoring dashboards and wallboards.* Vendor & Hybrid Model Governance: Track record managing an external Tier 1 MSSP, including SLA monitoring and alert tuning.* Escalation Management: Experience running Tier 2 triage and collaborating directly with enterprise Incident responders on high-severity incidents.* Preferred Certifications: CISSP or related GIAC certifications