Security Operations Center (SOC) Manager
Future Opportunity — Not Currently Hiring
Position Overview
The SOC Manager is responsible for the overall leadership, effectiveness, maturity, and continuous improvement of the Security Operations Center (SOC). This role owns the operational performance of SOC services, ensuring effective security monitoring, threat detection, incident investigation, response coordination, and continuous improvement across managed client environments.
The SOC Manager leads the SOC team by establishing operational standards, developing technical capability, managing staffing and performance, improving processes, and ensuring security services are delivered consistently and effectively. This role is accountable for maintaining a disciplined security operations function that supports client security objectives while aligning with organizational risk priorities and service expectations.
The SOC Manager works closely with SOC Engineering, NOC, Service Desk, Automation & Integration Engineering, Compliance & Risk, Customer Success, and client stakeholders to improve detection capabilities, operational maturity, and overall security service delivery.
Key Responsibilities
SOC Leadership & Team Development
- Lead, coach, and develop SOC analysts, engineers, and security operations personnel
- Establish performance expectations, provide regular coaching, and support career development
- Develop training plans to improve analyst capability, investigation quality, and operational readiness
- Support recruitment, onboarding, and retention of SOC team members
- Build a culture of accountability, technical excellence, continuous learning, and security discipline
- Identify skill gaps and create development plans to improve SOC capability
Security Operations Management
- Own daily SOC operational effectiveness, including monitoring, alert triage, investigation, escalation, and incident response activities
- Ensure ticket and phone coverage is appropriately staffed and balanced across the SOC team
- Provide backup ticket and phone coverage during staffing shortages, peak demand, or major security incidents as needed
- Ensure SOC processes support timely identification, prioritization, and response to security events
- Maintain operational standards for incident handling, escalation procedures, communications, and service delivery
- Ensure appropriate staffing models, scheduling, and resource allocation support 24×7 security operations
- Ensure SOC services meet client commitments, operational expectations, and defined service objectives
- Coordinate with internal teams and client stakeholders during security events and operational escalations
Incident Response & Security Readiness
- Maintain effective incident response processes, playbooks, escalation paths, and operational procedures
- Provide leadership during major security incidents and complex investigations
- Ensure post-incident reviews are completed, and improvement opportunities are identified
- Partner with technical teams to improve response capability and reduce operational risk
- Support security assessments, audits, and client security reviews as required
Detection, Monitoring & Service Improvement
- Partner with SOC Engineering to improve detection coverage, alert quality, and security monitoring capabilities
- Review SOC performance trends and identify opportunities to improve effectiveness
- Reduce operational inefficiencies through process improvement, automation, and workflow optimization
- Support improvements to SIEM, EDR/XDR, SOAR, vulnerability management, and related security platforms
- Promote proactive security operations practices
Metrics, Reporting & Operational Visibility
- Define, measure, and report SOC operational metrics including response times, alert trends, investigation quality, workload, and service performance
- Provide leadership visibility into SOC performance, risks, trends, and improvement initiatives
- Use operational data to drive decision-making and resource planning
- Establish reporting practices that demonstrate SOC effectiveness to internal and client stakeholders
Documentation & Knowledge Management Accountability
- Establish expectations for SOC documentation quality, consistency, and operational usability
- Ensure analysts maintain accurate playbooks, investigation procedures, escalation guides, and knowledge resources
- Promote knowledge sharing and continuous improvement of SOC documentation
- Ensure operational knowledge is captured and available across the SOC team
Cross-Functional Collaboration
- Partner with Compliance & Risk on security controls, evidence collection, audits, and security maturity initiatives
- Collaborate with NOC and Service Desk teams on security-related operational issues
- Work with Automation & Integration Engineering to improve workflows, automation, and operational efficiency
- Support Customer Success and client-facing teams with security operations insights and service improvement opportunities
- Provide technical leadership during security service discussions when appropriate
Required Qualifications
- Proven experience leading or managing a Security Operations Center, security operations team, or cybersecurity monitoring function
- Strong understanding of SOC operations, incident response, threat detection, and security monitoring practices
- Demonstrated experience managing technical teams and developing cybersecurity professionals
- Experience establishing operational metrics, processes, and continuous improvement initiatives
- Experience operating within a structured security operations environment with defined procedures and escalation processes
- Strong communication skills with the ability to communicate cybersecurity risks and priorities to technical teams, leadership, and clients
Preferred Qualifications
- Experience working within a Managed Security Service Provider (MSSP) environment
- Experience supporting multiple client security environments
- Experience managing SIEM, SOAR, EDR, XDR, vulnerability management, or security analytics platforms
- Experience with security frameworks such as NIST Cybersecurity Framework, CIS Controls, or MITRE ATT&CK
- Experience developing security operations processes, playbooks, and maturity models
- CISSP
- CISM
- GIAC certifications
- CompTIA Security+
- or equivalent experience
Professional Skills
- Leadership and team development
- Analytical thinking and decision making under pressure
- Prioritization of competing demands in a 24×7 environment
- Documentation and process discipline
- Communicating complex security concepts to technical and non-technical audiences
- Continuous improvement mindset
Success Measures
- Improved SOC operational maturity and service effectiveness
- Strong analyst engagement, capability development, and retention
- Consistent achievement of SOC service objectives and response metrics
- Improved detection quality, investigation processes, and incident response capability
- Increased automation and operational efficiency
- Improved client confidence in SOC services
- Accurate documentation and repeatable security operations processes
Career Growth Opportunity
This role provides opportunities to advance into Director of Security Operations, Director of Managed Security Services, VP of Security Operations, Chief Information Security Officer (CISO) track, or broader cybersecurity and technology operations leadership roles.
The SOC Manager gains broad exposure across detection engineering, incident response leadership, compliance and risk management, and managed security services delivery while building executive-level security leadership capability.
Benefits
About NOCDOC
NOCDOC is a U.S.-based technology operations company with more than 35 years of experience delivering Security Operations Center (SOC), Network Operations Center (NOC), Service Desk, Network Engineering, Automation, and Managed Security Services.
Supporting organizations across North America and internationally, NOCDOC delivers responsive, customer-focused technology operations that help businesses improve reliability, security, and operational efficiency.
At NOCDOC, we invest in our people through continuous learning, mentorship, and career development, providing opportunities to grow into advanced engineering, automation, architecture, and technical leadership roles.