Cyber Operations Manager - SIEM/Incident Response/Azure

• Lead, coach and develop the cyber security operations team.
• Oversee threat monitoring, investigation and response, acting as a technical escalation point.
• Lead security incidents, coordinating investigation, containment, recovery and post-incident improvements.
• Develop and tune SIEM detection rules, response playbooks and operational procedures.
• Improve security controls across cloud, identity, endpoint, email and network environments.
• Drive threat hunting and translate threat intelligence into defensive improvements.
• Manage vulnerability prioritisation and work with IT teams to deliver timely remediation.
• Manage outsourced security providers and hold suppliers accountable for service performance.
• Provide technical security input into technology projects and change initiatives.

• At least five years’ relevant cyber security experience within a regulated environment.
• Proven experience leading cyber security operations teams.
• Strong hands-on security engineering and incident response capabilities.
• Broad technical knowledge covering Azure, Entra ID, SIEM, detection engineering, EDR, email security, identity and access management, vulnerability management, network security and SASE.
• Experience managing outsourced security services.
• Strong communication skills, including explaining technical risks to non-technical stakeholders.

Experience transforming security operations, working with managed SOC services, security automation or purple teaming would be advantageous. Relevant qualifications such as CISSP, CISM or GIAC, or equivalent demonstrable experience, are sought.

This opportunity would suit a technical cyber operations leader who wants to combine team development with direct ownership of improvements to security capability.