SOC Manager

Managed.sa; Riyadh; On-site; SAR 240,000 - 360,000; Full time

Job summary

Managed.sa is seeking an experienced SOC Manager to lead Security Operations Center activities, strengthen threat detection and incident response, and ensure delivery of SOC services on-site in Riyadh. The ideal candidate combines hands-on cybersecurity expertise with strong leadership, stakeholder management, and operational reporting.

The role requires 5-7 years of SOC/IR experience, hands-on SIEM work with Splunk/QRadar/Elastic, and on-site availability in Riyadh, with a focus on continuous

Qualifications

• 5-7 years of cybersecurity experience with strong exposure to SOC operations and incident response.
• Experience leading SOC activities, security operations, or technical teams.
• Hands-on experience with Splunk, QRadar, Elastic, or similar SIEM platforms.
• Strong knowledge of cyber threats, attack vectors, detection techniques, and defense strategies.
• Familiarity with MITRE ATT&CK, threat intelligence, endpoint security, and network-security monitoring.
• Strong leadership, analytical, communication, and stakeholder-management skills.
• Ability to work full-time on-site in Riyadh.

Responsibilities

• Lead daily SOC operations, including security monitoring, alert triage, investigation, escalation, and incident response
• Manage, coach, and support SOC analysts while ensuring procedures and service levels
• Lead the investigation and response to major security incidents
• Work with SIEM platforms such as Splunk, QRadar, or Elastic
• Develop and improve detection rules, use cases, playbooks, and escalation procedures
• Conduct root‑cause analysis and post‑incident reviews
• Support digital forensics and evidence‑handling activities
• Monitor emerging cyber threats, attack vectors, and adversary techniques
• Track SOC performance through SLAs, KPIs, and operational metrics
• Prepare incident, operational, and management reports
• Coordinate with clients and internal technical teams during security incidents
• Identify team development and training needs

Skills

Leadership

Stakeholder management

Analytical thinking

Communication

Team coaching

Operational reporting

Education

Bachelor's degree in Cybersecurity/Information Security/CS

Tools

Splunk

QRadar

Elastic

Job description

Managed.sa is seeking an experienced SOC Manager to lead Security Operations Center activities, strengthen threat detection and incident-response capabilities, and ensure the effective delivery of SOC services.

The ideal candidate combines hands‑on cybersecurity expertise with strong leadership, stakeholder management, and operational reporting skills.

Key Responsibilities

• Lead daily SOC operations, including security monitoring, alert triage, investigation, escalation, and incident response
• Manage, coach, and support SOC analysts while ensuring compliance with defined procedures and service levels
• Lead the investigation and response to major security incidents
• Work with SIEM platforms such as Splunk, QRadar, or Elastic
• Develop and improve detection rules, use cases, playbooks, and escalation procedures
• Conduct root‑cause analysis and post‑incident reviews
• Support digital forensics and evidence‑handling activities
• Monitor emerging cyber threats, attack vectors, and adversary techniques
• Track SOC performance through SLAs, KPIs, and operational metrics
• Prepare incident, operational, and management reports
• Coordinate with clients and internal technical teams during security incidents
• Identify team development and training needs

Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or a related field
• 5-7 years of cybersecurity experience, with strong exposure to SOC operations and incident response
• Previous experience leading SOC activities, security operations, or technical teams
• Hands‑on experience with Splunk, QRadar, Elastic, or similar SIEM platforms
• Strong knowledge of cyber threats, attack vectors, detection techniques, and defense strategies
• Strong understanding of incident response and digital forensics
• Familiarity with MITRE ATT&CK, threat intelligence, endpoint security, and network‑security monitoring
• Strong leadership, analytical, communication, and stakeholder‑management skills
• Ability to work full‑time on‑site in Riyadh

Preferred Certifications

Relevant certifications such as:

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Equivalent cybersecurity certifications