Want to know if this job is worth applying to?
Bengaluru, Karnataka, India
Remote only
Not Available
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Operations Center Manager based in India.
As Security Operations Center Manager, you will lead a 24/7 security operations function responsible for monitoring client environments, investigating threats, and delivering actionable security insights. You will manage and develop a team of 10 or more SOC analysts across rotating shifts, ensuring consistent coverage, high-quality investigations, and reliable service delivery. Combining hands-on security expertise with operational leadership, you will oversee detection capabilities across EDR, SIEM, firewalls, IPS, and WAF technologies. You will also serve as a senior point of contact for clients, guiding escalations, communicating incident findings, and driving continuous service improvements. Working closely with security, governance, risk, and compliance specialists, you will help align monitoring activities with client security and regulatory requirements. This remote opportunity offers the chance to strengthen security operations, develop talent, and shape scalable managed detection and response services.
Team Leadership and Development
Lead, coach, and develop a team of 10 or more SOC analysts through regular one-on-one meetings, clear performance goals, and constructive feedback.
Build and maintain a reliable 24/7 shift schedule, ensuring appropriate staffing and skill coverage across nights, weekends, and public holidays.
Recruit, interview, onboard, and train analysts, helping new team members develop the skills needed to investigate alerts independently.
Establish career development plans and support relevant training and professional certification goals.
Monitor team engagement, workload, burnout, and retention risks to maintain a sustainable and effective operating environment.
Security Operations and Service Quality
Own SOC performance against client service-level agreements (SLAs), tracking key metrics such as acknowledgment time, investigation time, escalation quality, and false-positive rates.
Review investigations and escalations for accuracy, completeness, technical quality, and clarity before findings are communicated to clients.
Oversee security monitoring across endpoint detection and response (EDR), security information and event management (SIEM), firewalls, intrusion prevention systems (IPS), and web application firewalls (WAF).
Prioritize detection engineering and tuning initiatives to reduce alert noise, address coverage gaps, and improve threat identification.
Maintain operational runbooks, investigation playbooks, and shift handoff procedures to ensure continuity across the 24/7 operation.
Lead post-incident reviews and translate lessons learned into improved detection logic, operating procedures, and analyst training.
Client Relationship Management
Serve as the senior point of contact for clients regarding SOC service delivery, incident escalations, and security communications.
Lead recurring service reviews covering alert volumes, significant incidents, emerging trends, SLA performance, and recommended improvements.
Partner with clients during onboarding to define log sources, security tooling, escalation procedures, and incident response responsibilities.
Manage client concerns and escalations with urgency, sound judgment, and clear communication, taking ownership of decisions when immediate direction is unavailable.
Provide actionable findings and remediation guidance while clearly communicating client responsibilities for implementing responses within their own environments.
Reporting and Cross-Functional Collaboration
Report regularly to leadership on SOC performance, staffing, operational risks, service quality, and improvement initiatives.
Collaborate with governance, risk, and compliance specialists and virtual CISOs to ensure security monitoring supports client obligations and audit readiness.
Help align SOC activities with relevant frameworks, including SOC 2, ISO 27001, and HIPAA, where applicable.
Identify opportunities to improve security tooling, automation, workflows, and reporting, building business cases for operational investment.
Develop metrics and dashboards that provide clear visibility into operational performance, client outcomes, and opportunities for improvement.
Professional Experience: At least 7 years of experience in security operations, including a minimum of 3 years managing a SOC team or a comparable security operations function.
24/7 SOC Management: Demonstrated experience running round-the-clock security operations, maintaining service quality, staffing coverage, and team morale across rotating shifts.
People Leadership: Experience managing teams of 10 or more analysts, including recruitment, onboarding, scheduling, performance management, coaching, and professional development.
Security Technology Expertise: Strong working knowledge of EDR, SIEM, firewalls, IPS, and WAF platforms, with sufficient hands-on expertise to review investigations, assess detection quality, and identify missed indicators or investigative gaps.
Incident Investigation and Escalation: Ability to evaluate security alerts, guide investigations, assess operational risk, and communicate findings and recommended remediation actions effectively.
Client Management: Experience managing client relationships, handling escalations, and presenting incident findings, security trends, and SLA performance to both technical teams and executive stakeholders.
Decision-Making Under Pressure: Strong judgment, composure, and accountability when managing active incidents, service disruptions, and time-sensitive escalations.
Communication Skills: Excellent written and verbal English, with the ability to produce clear investigation reports, communicate complex security issues, and maintain professional client relationships across global teams.
Operational Discipline: Experience establishing effective shift handoffs, maintaining runbooks, monitoring service metrics, and driving continuous improvement in a 24/7 environment.
Flexibility: Willingness to work flexible hours when required to support operational coverage, incident escalations, and shift transitions.
Professional Certifications: Active security or leadership certifications such as CISSP, CISM, GCIH, GCIA, or equivalent are advantageous.
Managed Security Services Experience: Previous experience in a managed security services provider (MSSP) environment, supporting multiple client environments simultaneously, is preferred.
Security Tool Administration: Hands-on experience configuring, maintaining, and tuning EDR, SIEM, firewall, IPS, or WAF platforms is beneficial.
Automation and Scripting: Familiarity with Python, PowerShell, or security orchestration, automation, and response (SOAR) playbooks to reduce manual triage and reporting is an advantage.
Compliance Knowledge: Understanding of frameworks such as SOC 2, ISO 27001, and HIPAA, including how security operations contribute to compliance and audit readiness, is desirable.
Metrics and Reporting: Experience building SOC dashboards, performance metrics, and reports for clients and leadership is beneficial.
Remote Work Requirements: A reliable, high-speed internet connection and a professional home office suitable for confidential discussions and uninterrupted collaboration.
Working Hours: Ability to work a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time to support global collaboration and timely communication.
Travel Availability: Willingness to travel locally for occasional in-person meetings, team gatherings, or business activities as needed.
Competitive compensation: A competitive base salary, regular performance reviews linked to merit-based appraisals, and bonus opportunities.
Career development: Clear opportunities for career progression, mentorship, and professional growth.
Training and certifications: Reimbursement for approved training programs and certification courses relevant to your role, subject to the applicable program terms.
Remote-first flexibility: The ability to work remotely from India while collaborating with a globally distributed team.
Career advancement: Opportunities to take on greater responsibility and contribute to the growth of an expanding security services organization.
Continuous learning: Exposure to a range of client environments, security technologies, threat investigations, and managed detection and response practices.
Leadership impact: The opportunity to build a high-performing SOC team, strengthen operational processes, and influence service quality and client outcomes.
