We are seeking a highly motivated and strategic SOC Manager to lead and mature our global 24x7 Security Operations Center. In this pivotal role, you will act as the bridge between high-level business priorities and technical execution, overseeing a unified defense strategy across internal teams and MSSP partners. You will be responsible for the operational oversight and continuous improvement of our security posture, with a focused emphasis on maximizing our CrowdStrike MDR partnership. By ensuring that Falcon telemetry, Proofpoint email security, and Palo Alto network defenses seamlessly integrate with internal workflows, you will provide comprehensive protection for the enterprise around the clock.
This role is hands-on and operational. The ideal candidate should have strong experience in security investigations and incident response, and can coach, mentor and guide the junior analysts during high-severity events. You will help improve incident response capabilities through practical experience and collaboration with Red, Blue, and Purple Teams. The position requires comfort working in a 24x7 shift-based environment, including leading major incident calls and handling escalations when needed. Your mission is to provide threat hunting and bring threat intelligence into clear actions that protect the business at all times.
Primary Responsibilities
SOC Operations & Security Monitoring
Lead day-to-day 24x7 SOC operations
Oversee monitoring and investigation across:
CrowdStrike MDR / Falcon (SIEM, EDR, threat telemetry)
Proofpoint (Email security, phishing analysis, TAP s)
Palo Alto Firewalls (network s, session monitoring, threat prevention)
Ensure timely triage, classification, and escalation of s based on severity and business impact.
Validate MDR escalations and ensure alignment with internal response playbooks.
Correlate events across endpoint, email, network, and cloud telemetry to detect attack patterns and lateral movement.
Ensure proper logging retention standards are implemented and maintained.
Incident Response Leadership & Escalation
Ensure implementation, maintenance, and continuous improvement of the Cybersecurity Incident Response Plan (CIRP).
Lead investigation of high-priority and critical security incidents.
Coordinate response activities across IT, infrastructure, business units, Legal, HR, and Compliance.
Oversee containment, eradication, recovery, and post-incident review.
Ensure Root Cause Analysis (RCA) reports are completed for major incidents.
Provide escalation advisory and executive-ready summaries during major events.
Phishing, Email Security & Brand Protection Oversight
Oversee phishing investigations and campaign-level analysis using Proofpoint.
Approve blocking of malicious IPs, URLs, domains, and sender IDs.
Monitor large-scale phishing or impersonation campaigns and coordinate mitigation strategy.
Ensure Content Search & Purge processes are executed when required.
Threat Intelligence & Proactive Defense
Guide intelligence-driven threat hunting using TTP-based methodologies.
Lead proactive threat hunting using CrowdStrike telemetry and SIEM datasets.
Recommend improvements to incident classification matrix and severity assignment.
Collaborate with red/purple teams to validate detection capabilities and improve playbooks.
Firewall & Network Security Oversight (Palo Alto)
Oversee investigation of firewall s including session limit events, scanning attempts, and exploit activity.
Coordinate appropriate blocking on Palo Alto.
Coordinate with network teams for DoS policy tuning and traffic validation.
Monitor for suspicious ingress/egress traffic patterns and unauthorized access attempts.
Process, Documentation & Compliance
Oversee development and quarterly updates of operational runbooks.
Ensure SOC processes align with regulatory frameworks (ISO 27001, NIST, SOC 2, etc.).
Review and approve runbooks within defined timelines.
Support internal and external audits with timely documentation and evidence.
Reporting & Executive Communication
Deliver daily, weekly, and monthly SOC performance reports as directed.
Provide business-focused summaries on major incidents and emerging threats.
Translate technical findings into clear, executive-level impact statements.
Provide trend analysis across endpoint, email, and network security domains.
Key Expectations
Operate effectively in a 24x7 shift-based security environment.
Lead by example during high-pressure incidents.
Ensure consistent, high-quality incidents handling across all technologies.
Continuously improve detection, response, and operational maturity.
Serve as the escalation point for complex technical and operational security matters.
Required Qualifications
Experience
5–8+ years in security operations, incident response, or threat detection.
2–4 years in a SOC or IR role, with at least 2 years in a leadership or team‑lead capacity.
Hands‑on experience with SIEM platforms (CrowdStrike MDR), Proofpoint, EDR tools (CrowdStrike, Defender for Endpoint), and network security monitoring.
Technical Skills
Strong understanding of attack techniques and threat actor behaviors (MITRE ATT&CK).
Experience with log analysis, packet capture tools, and forensic techniques.
Basic scripting skills preferred (PowerShell, Python) for automation and investigation tasks.
Familiarity with cloud security, identity telemetry, and modern detection strategies.
Certifications (Preferred)
CompTIA Security+, CySA+, GCIA, GCIH, or equivalent.
CrowdStrike certifications (CCFA, CCFR, CCFH) are a plus.
Exposure to Red/Blue/Purple Team methodologies is beneficial.
Preferred Attributes
CrowdStrike certifications (CCFA, CCFR, CCFH).
Experience with SOAR platforms, SIEM tools, and cloud security monitoring.
Strong Incident analysis and reporting skills is a must.
Ability to work effectively in a fast‑paced, 24x7 SOC environment.
Excellent communication, leadership, and documentation skills.
Ability to translate technical findings into business‑relevant insights.
