Director, Security Operations Center

Job Summary

The Director of the Security Operations Center (SOC) is responsible for leading and managing the organization’s cybersecurity monitoring and incident response operations. This role oversees a team of security analysts, engineers, and incident responders to ensure the confidentiality, integrity, and availability of enterprise systems and data. The SOC Director will develop strategies, implement technologies, and coordinate responses to security threats and incidents.

Duties and Responsibilities

• Lead day-to-day SOC operations including monitoring, detection, analysis, and incident response.
• Develop and maintain SOC policies, procedures, and playbooks aligned with frameworks like NIST, MITRE ATT&CK.
• Oversee deployment, tuning, and optimization of SIEM, SOAR, IDS/IPS, EDR, and threat intel platforms.
• Coordinate cross-functional incident response and lead post-incident reviews.
• Work with IT, legal, compliance, and business units to align with risk management goals.
• Monitor emerging threats and adjust defenses and strategies proactively.
• Recruit, mentor, and develop SOC staff, fostering continuous improvement.
• Prepare and present SOC performance, threat landscape, and risk posture to executives.
• Ensure SOC operations meet standards like GDPR, HIPAA, PCI-DSS, ISO 27001.

Qualifications

Education Required:

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Information Technology, or a related field

Experience Required:

• 10+ years of experience in cybersecurity, with at least 5 years in a leadership role within a SOC or similar environment

Experience Preferred:

• 15+ years of experience in cybersecurity, with at least 7 years in a leadership role within a SOC or similar environment

Licenses/Certifications Required:

• CISSP, CISM, GIAC, CEH, or equivalent

Technical Skills and Abilities

• Deep understanding of cybersecurity principles, threat intelligence, and incident response.
• Strong leadership and team management skills.
• Experience with security technologies (e.g., Sentinel, QRadar, Palo Alto, CrowdStrike).
• Excellent communication and stakeholder management abilities.
• Ability to work under pressure and manage multiple priorities in a fast-paced environment.

Physical Demands:

Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.