Head of Security Operations

Sokin

Head of Security Operations at Sokin, leading security operations, incident management, and vulnerability functions. Based in London or Dubai, this role shapes the future of security operations.

Posted 8/3/2026full-timeLondon • 🇬🇧 United KingdomLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations management, including incident response, vulnerability management, and identity governance. Proficient in Microsoft Sentinel and MITRE ATT&CK framework for effective detection and threat intelligence integration.

Highest-signal resume keywords

Microsoft Sentinel ExperienceKQL ProficiencyIncident Response and Digital ForensicsVulnerability Management ProgramMSSP Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Strategy DevelopmentIncident ManagementForensic AnalysisThreat Intelligence IntegrationData Source OnboardingDetection Rule AuthoringMITRE ATT&CK KnowledgeIdentity GovernanceVulnerability ManagementSIEM Scaling

Soft Skills

Strong Written Communication

Tools & Technologies

Microsoft SentinelSIEM

Industry Keywords

Security OperationsIncident ResponseDigital ForensicsThreat IntelligenceMSSPSOCAccess Risk

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Own security operations at Sokin: build it, run it, and grow it
Define and maintain the detection strategy, mapped to MITRE ATT&CK
Set the standards and review bar for Microsoft Sentinel content
Onboard new log sources and systems into the detection pipeline
Consume threat intelligence and translate it into detection and hunting priorities
Own the MSSP /outsourced SOC relationship end to end
Lead incident response: own L3 investigation and forensic analysis
Own incident management end to end alongside the CISO
Own vulnerability management as a program
Own identity governance within security operations
Manage the security operations team
Support the CISO on incident communication and reporting

Requirements

What you’ll need

Deep Microsoft Sentinel experience: KQL proficient, able to author and critically review detection rules, workbooks, and playbooks
Experience onboarding new data sources into a SIEM and scaling detection coverage as an environment grows
Hands-on incident response and digital forensics experience across cloud and endpoint
Experience sharing ownership of the incident management process
Applied MITRE ATT&CK knowledge used in detection engineering
Experience running or managing vulnerability management as a program
Working knowledge of identity governance and access risk
Experience managing an MSSP /outsourced SOC relationship
Strong written communication for incident reports and RCAs

Benefits

Comp & perks

Health insurance
Flexible work arrangements
Professional development opportunities