Cyber Security Soc Manager

Bottomline It; Gauteng; On-site; ZAR 600 000 - 800 000; Full time

Job summary

A managed security service provider is seeking a SOC Manager to oversee security operations for multiple clients in Gauteng, South Africa. This role involves managing a 24/7 SOC team, customizing threat detection for client environments, and ensuring compliance with security standards. The ideal candidate will have strong technical expertise in SIEM and excellent client communication skills. Relevant certifications such as CISSP or CISM are preferred.

Qualifications

• Experience managing a SOC for multiple clients.
• Proficiency in cloud security (AWS / Azure / GCP).
• Ability to customize threat detection rules.

Responsibilities

• Manage a 24/7 SOC team across shifts.
• Act as the primary security liaison for clients.
• Oversee real-time monitoring via SIEM.
• Deliver executive reports on threat trends.
• Refine SOC workflows with automation.

Skills

Technical Expertise

Client Communication

Leadership

Education

Certifications – CISSP, CISM, GIAC (GCIH, GSOC), CCSP

Tools

SIEM (e.g., Splunk, Microsoft Sentinel)

EDR / XDR systems

Firewalls / IDS / IPS

Job description

Introduction

SOC Manager for a Managed Security Service Provider (MSSP) plays a critical role in overseeing security operations for multiple clients, ensuring threat detection, incident response, and compliance across various environments.

This role requires a mix of technical expertise, leadership, and client management skills since the SOC serves external organizations rather than a single in-house team.

Duties & Responsibilities

SOC Operations & Team Leadership:
- Manage a 24/7 SOC team (Tier 1, 2, and 3 analysts) across shifts.
- Define and enforce SOPs (Standard Operating Procedures) for monitoring, triage, and escalation.
- Ensure SLAs (Service Level Agreements) are met for clients (e.g., response times, uptime).
- Conduct performance reviews, training, and skill development for analysts.

Client-Focused Security Management:
- Act as the primary security liaison for clients, providing updates on threats, incidents, and recommendations.
- Customize threat detection rules (SIEM tuning) per client environment (e.g., Azure, AWS, on-prem).
- Deliver monthly / quarterly security reports (KPIs, incidents, trends).
- Assist in pre‑sales discussions (explaining SOC capabilities to prospects).

Threat Detection & Incident Response:
- Oversee real‑time monitoring via SIEM (e.g., Splunk, Microsoft Sentinel, LogRhythm).
- Manage major security incidents (ransomware, breaches, insider threats) with cross‑team coordination.
- Implement automated response (SOAR) to improve efficiency (e.g., automated phishing remediation).
- Conduct threat hunting based on client‑specific risks.

Technology & Tooling Management:
- Oversee multi‑tenant SIEM (e.g., SGBox, Splunk ES, Microsoft Sentinel, LogRhythm).
- Manage EDR / XDR, SOAR, and threat intelligence platforms.
- Optimize alert rules to reduce noise and improve detection accuracy.

Client Communication & Reporting:
- Act as the primary escalation point for major security incidents.
- Deliver executive reports on threat trends, incidents, and risk posture.
- Advise clients on security improvements and compliance (e.g., NIST, ISO, POPIA, GDPR).

Continuous Service Improvement:
- Perform threat hunting and proactive vulnerability assessments.
- Refine SOC workflows with automation (SOAR) and AI‑driven analytics.
- Stay updated on emerging threats (ransomware, zero‑days, supply chain attacks).

Desired Experience & Qualifications

Technical Expertise – SIEM, EDR, firewall / IDS / IPS, cloud security (AWS / Azure / GCP).

MSSP Experience – Managing security for multiple clients with different needs.

Certifications – CISSP, CISM, GIAC (GCIH, GSOC), CCSP (for cloud security).

Soft Skills – Strong client communication, SLA management, and leadership.