This is a growing cyber security business with a clear mission: to bring enterprise-grade security capability to small and medium-sized businesses that are typically underserved by traditional providers. Founded by practitioners who built their careers delivering security for large enterprises and central government, the business has a strong operational pedigree and a genuine understanding of what good looks like.

The core service is Managed Detection and Response, and the SOC sits at the heart of that. The team is small, technically strong, and building something with real ambition. This hire is a significant one: the SOC Manager will shape how the function operates, develops, and scales as the business grows.

The culture is practical and direct. There are no unnecessary layers, performance is taken seriously, and people are trusted to own their work. If you want to lead a SOC that is building its own playbook rather than following someone else's, this is the right environment.

As SOC Manager, you'll take full accountability for the day-to-day delivery and continuous improvement of a Managed Detection and Response service across a portfolio of clients, leading a growing team of SOC Analysts and acting as the senior escalation point for incidents, client communications, and service quality.

• Own MDR service delivery across a portfolio of clients, maintaining performance against SLAs, KPIs, and contractual commitments
• Act as the primary operational escalation point for clients and internal teams during incidents and service issues
• Lead service reviews, governance meetings, and executive briefings, presenting incidents, trends, and recommendations clearly and commercially
• Manage major incident escalations, ensuring responses are controlled, well-communicated, and documented
• Lead client onboarding and service transition, coordinating deployment, documentation, and stakeholders
• Line manage, coach, and develop SOC Analysts and Senior SOC Analysts through regular one-to-ones, performance reviews, and development planning
• Set clear expectations for investigation quality, ownership, communication, and timeliness
• Review investigations and incident reports, challenging incomplete analysis and weak conclusions
• Maintain oversight of detection coverage across client environments, ensuring alerts and incidents are investigated consistently
• Work with engineers and platform specialists to improve detection use cases, reduce false positives, and identify automation opportunities
• Support threat hunting and the effective use of threat intelligence
• Own and continuously improve runbooks, playbooks, workflows, and operational procedures
• Use operational data to identify weaknesses, prioritise improvements, and develop repeatable operating models that allow the SOC to scale
• Support pre-sales discussions, service designs, and Statements of Work where SOC expertise is required
• Maintain technical credibility through relevant learning and industry engagement

• Proven experience leading or supervising a SOC or security operations team, within an MSSP, MDR provider, or in-house environment
• Strong practical knowledge across SIEM, EDR/XDR, incident response, alert triage, detection engineering, threat hunting, automation, and SOC reporting
• Microsoft Sentinel and Defender experience is highly desirable
• Able to communicate complex security and operational matters clearly and confidently with clients and senior stakeholders, both written and verbal
• Technically credible enough to recognise poor analysis, challenge investigations, and provide credible direction to the team
• Strong background in cyber security or a related technical discipline, gained through experience, qualifications, or education
• Two or more relevant certifications preferred, examples include SC-200, AZ-500, CISSP, CISM, GCIA, GCIH, CompTIA CySA+, and CREST Certified Intrusion Analyst
• Must have the right to work in the UK. This role does not offer visa sponsorship

• Salary £90,000 - £100,000 depending on experience
• 25 days annual leave plus bank holidays, with one additional day for every 12 months of service
• Hybrid working, three days per week in central London with flexibility for the remaining two
• Individual training plan with budget for one professional certification or course per year
• Regular team socials and activities