SOC Operations Team Lead

Methods

Lead day-to-day operations of the Security Operations Centre ensuring high-quality security monitoring and incident response. Provide technical leadership and drive continuous improvement across SOC processes.

Posted 7/10/2026full-timeLondon • 🇬🇧 United KingdomSeniorWebsite

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Lead the day-to-day operation of the Security Operations Centre, ensuring high-quality security monitoring, incident response and threat detection services.
Provide technical leadership, mentoring and coaching to SOC Analysts, supporting their development and driving consistent investigation standards.
Act as the senior escalation point for complex or high-priority security incidents, providing technical oversight and coordinating response activities.
Oversee incident investigations using Microsoft Sentinel, Microsoft Defender XDR and Microsoft Entra ID, ensuring incidents are accurately prioritised, investigated and resolved.
Drive continuous improvement across SOC processes, detection engineering, automation, playbooks and operational procedures to enhance service quality and efficiency.
Monitor SOC performance against KPIs and SLAs, producing operational reporting and identifying opportunities to improve service delivery.
Build strong relationships with customers and internal stakeholders, providing technical guidance and contributing to service reviews and operational governance.
Support onboarding of new security technologies, telemetry sources and Microsoft security capabilities, ensuring they are effectively integrated into SOC operations.
Promote operational excellence by identifying gaps in tooling, processes or detection coverage and implementing practical improvements.
Contribute to the ongoing maturity of the SOC, ensuring services remain proactive, resilient and aligned with evolving cyber threats.

Requirements

What you’ll need

Experience leading, mentoring or supervising analysts within a Security Operations Centre.
Strong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR and Microsoft Entra ID.
Proven experience managing complex cyber security incidents through investigation, containment and resolution.
Strong understanding of security operations, threat detection, incident response and Microsoft security technologies.
Experience improving SOC processes, detection capability, automation and operational maturity.
Ability to lead technical discussions and communicate effectively with customers, stakeholders and internal teams.
Experience producing operational metrics, reporting and service performance insights.
Understanding and operating with ITIL Incident Management processes
Familiarity with SIEM, SOAR, XDR, MITRE ATT&CK and ITIL-based service environments.

Benefits

Comp & perks

Autonomy to develop and grow your skills and experience
Be part of exciting project work that is making a difference in society
Strong, inspiring and thought-provoking leadership
A supportive and collaborative environment
Development – access to LinkedIn Learning, a management development programme, and training
Wellness – 24/7 confidential employee assistance programme
Flexible Working – including home working and part time
Social – office parties, breakfast Tuesdays, monthly pizza Thursdays, Thirsty Thursdays, and commitment to charitable causes
Time Off – 25 days of annual leave a year, plus bank holidays, with the option to buy 5 extra days each year
Volunteering – 2 paid days per year to volunteer in our local communities or within a charity organisation
Pension – Salary Exchange Scheme with 4% employer contribution and 5% employee contribution
Life Assurance – of 4 times base salary
Private Medical Insurance – which is non-contributory (spouse and dependants included)
Worldwide Travel Insurance – which is non-contributory (spouse and dependants included)
Enhanced Maternity and Paternity Pay
Travel – season ticket loan, cycle to work scheme

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

Security OperationsThreat DetectionIncident InvestigationOperational ReportingAutomationDetection EngineeringCyber Security Incident ManagementKPI MonitoringService Level Agreement ManagementITIL Incident Management

Soft Skills

Technical LeadershipMentoringEffective CommunicationRelationship BuildingStakeholder Engagement