SOC Manager

Private Advertiser; Kuala Lumpur; On-site; MYR 240,000 - 360,000; Full time

Job summary

The Private Advertiser in Kuala Lumpur is seeking an experienced SOC Manager to lead a 24/7 Security Operations Centre. You will drive shift planning, team leadership, and the end-to-end incident response while tuning Microsoft Sentinel for optimal detection and response.

Reporting to Security Operations, you will supervise multi-tier analysts, conduct Level 2 root-cause analysis, and coordinate ITSM alignment to maintain SLAs.

Qualifications

• 8+ years in cybersecurity or security operations.
• 2–3+ years in a SOC leadership role managing 24/7 teams.
• Hands-on with Microsoft Sentinel analytics, workbooks and playbooks.
• Strong ITSM process and ticket lifecycle knowledge.
• Experience reviewing security posture across architecture, network and infrastructure.

Responsibilities

• Manage and lead the 24/7 Security Operations Centre, including planning, scheduling and rosters.
• Oversee the operation and tuning of Microsoft Sentinel (analytics rules, workbooks, automation).
• Drive end-to-end incident management (triage, investigation, escalation, containment and post-incident review).
• Ensure integration between SOC workflows and ITSM processes (tickets, SLA tracking).
• Perform Level 2 investigations and root cause analysis for complex incidents.
• Review security posture across architecture, network and infrastructure domains.
• Recruit, coach and mentor SOC analysts across tiers; conduct performance reviews.
• Develop and maintain SOC runbooks, playbooks and procedures.
• Report SOC performance, incident trends and KPIs/SLAs to stakeholders.

Skills

Leadership

Incident response

Team coaching

ITSM knowledge

Tools

Microsoft Sentinel

Logic Apps

Job description

We are seeking an experienced and driven SOC Manager to lead our 24/7 Security Operations Centre based in Kuala Lumpur. Reporting within the Security Operations department, you will own the end-to-end running of the SOC — from shift planning and team leadership through to advanced incident response and the continuous tuning of our Microsoft Sentinel platform.

You will lead a multi-tiered team of SOC analysts, ensuring uninterrupted monitoring and response coverage while fostering a culture of growth, accountability, and technical excellence. As the escalation point for complex incidents, you will personally perform Level 2 root cause analysis and conduct security posture reviews across architecture, network, and infrastructure domains ans signoff.

In this role, you will bridge security operations and IT service management, ensuring security incidents and service requests are handled within defined SLAs through seamless ITSM integration. Success in this position means a resilient, well-staffed, and continuously improving SOC that protects the organisation around the clock.

Responsibilities

Manage and lead the 24/7 Security Operations Centre, including planning, scheduling, and maintaining team shift rosters to guarantee uninterrupted monitoring and response coverage.

Oversee the operation and continuous tuning of Microsoft Sentinel, including analytics rules, workbooks, automation (Logic Apps/playbooks), and data connector health.

Drive incident management end-to-end — triage, investigation, escalation, containment, and post-incident review — in line with SLAs and established runbooks.

Ensure seamless integration between SOC workflows and ITSM processes, including ticket creation, categorization, prioritization, and SLA tracking for security incidents and service requests.

Perform Level 2 investigations and root cause analysis for complex security incidents, providing technical depth and escalation leadership.

Review the organisation's security posture across architecture, network, and infrastructure domains, translating findings into actionable detection and hardening recommendations.

Recruit, train, coach, and mentor SOC analysts across all tiers, conducting performance reviews and building individual development plans.

Develop, maintain, and continuously improve SOC runbooks, playbooks, and standard operating procedures.

Report on SOC performance, incident trends, and KPIs/SLAs to stakeholders and senior management, driving continuous service improvement.

Perform Level 2 root cause analysis and conduct security posture reviews across architecture, network, and infrastructure domains and signoff.

Requirements

Proven experience (typically 8+ years) in cybersecurity or security operations, with at least 2–3 years in a SOC leadership or supervisory capacity managing 24/7 shift-based teams.

Hands-on expertise with Microsoft Sentinel, including analytics rules, workbooks, Logic Apps/playbooks, and data connector management.

Solid experience in security incident management — triage, investigation, containment, escalation, and post-incident review — within SLA-driven environments.

Strong working knowledge of ITSM processes and tooling, including ticket lifecycle management, categorization, prioritization, and SLA tracking.

Technical competence in root cause analysis and reviewing security posture across architecture, network, and infrastructure domains.

Experience recruiting, coaching, and mentoring SOC analysts at L1 and L2 levels, including performance reviews and development planning.

Demonstrated ability to manage shift rosters and workforce scheduling to maintain continuous coverage.

Support ISO, NACSA and other documentations for the organizations.