Security Operations Center (SOC) Manager / Lead

If you are looking to excel and make a difference, take a closer look at us…

Overview:

We are seeking an experienced, proactive, and strategic SOC Lead to oversee and elevate our Security Operations Center. In this leadership role, you will be responsible for managing day-to-day SOC operations, driving our incident response and threat detection capabilities, refining detection engineering and automation pipelines, and mentoring a high-performing team of security analysts. If you are a seasoned security professional with proven operational leadership skills, sound incident command judgement, and a passion for defensive security excellence, we encourage you to apply.

Responsibilities:

SOC Operations:

• Oversee 24/7/365 monitoring coverage, shift handovers, alert triage, and ticket resolution workflows to ensure operational continuity and adherence to strict SLAs.
• Manage Operational Visibility & Daily Health Monitoring. Curate and maintain the central SOC operational wallboard / dashboard display, ensuring high-availability, accurate real-time telemetry, and clear visualization of floor operations.
• Lead SOC Engineers to track and display daily security health metrics, including: Pipeline & Tooling Health, Operational Queue Status. Curate Daily Mean Time to Acknowledge (MTTA), Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR) at dashboard.
• Conduct operational stand-ups using wallboard metrics to identify blind spots, ingestion drops, or anomalous spikes in alert trends.
• Track and report critical SOC performance metrics (e.g., MTTD, MTTR, false positive ratios, analyst queue health) to business stakeholders and senior leadership.

Incident Management:

• Serve as the primary technical bridge to incident responder personnel, formally escalating cyber incidents from SOC to the IR function and supporting blocking or containment action.
• Oversee rapid technical containment measures (host isolation via EDR, port/VLAN quarantine via NAC, identity suspension) during active intrusion attempts.

Detection Engineering & Threat Hunting:

• Steer proactive threat hunting across endpoints, network traffic, and cloud environments to uncover sophisticated threats, APTs, and living-off-the-land techniques.
• Partner with engineering teams to enhance detection logic, tune high-fidelity SIEM/EDR alerts, and operationalize MITRE ATT& CK mapping across all telemetry sources.
• Integrate actionable threat intelligence (IOCs, TTPs) into automated defense and hunting hypotheses.

Playbook Development, Automation & Governance:

• Standardize and regularly update standard operating procedures (SOPs), and escalation matrices.
• Drive workflow automation and orchestration to optimize L2 analyst response capacity.
• Ensure operational compliance with internal security policies and external regulatory frameworks (e.g., ISO 27001, SOC 2, HIPAA, PCI-DSS).

Team Leadership & Talent Development:

• Lead, mentor, and coach Tier 2 security analysts. Establish training roadmaps ,skill assessments, and career development paths to foster team retention and operational excellence.
• Govern daily service delivery, SLA adherence, and escalation handoffs from the Tier 1 MSSP. Lead operational reviews with MSSP counterparts to evaluate detection efficacy against evolving threats targeting the financial services sector.
• Cultivate a blameless, continuous-learning operational culture focused on proactive defense and technical rigor.

Cross-Functional Collaboration & Strategic Projects:

• Act as the technical liaison between the SOC, IT Infrastructure, Governance/Compliance teams and other business functions.
• Provide operational security input on architectural changes, tool evaluations, and cloud migrations.
• Coordinate with external managed service providers (MSSP/MDR), vendors, and law enforcement or regulatory entities when required.

Skills & Experience We Are Looking For:

Required Qualifications:

• Education & Experience: Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience; 6+ years of progressive experience in security operations, threat hunting, or incident response, including 1–2+ years of direct team lead, shift lead, or operational management experience.
• Technical Depth: Deep expertise with enterprise SIEM solutions (e.g., ArcSight, Qradar, Microsoft Sentinel, Splunk, Elastic) and modern EDR/XDR platforms(e.g., CrowdStrike, Defender for Endpoint, SentinelOne, Carbon Black).
• Architecture & Telemetry: In-depth knowledge of network protocols, operating systems (Windows, Linux, macOS), identity fabrics (Active Directory, Entra ID),and cloud security controls (AWS, Azure, or GCP).
• Frameworks & Methodologies: Practical application of security frameworks such as MITRE ATT& CK, Cyber Kill Chain, and NIST SP 800-61.
• Soft Skills: Exceptional leadership, stakeholder communication, and analytical decision-making capabilities.

Preferred Qualifications:

• Certifications: Advanced industry certifications such as CISSP, GSEC, GCDA,CISM, GCIH, GCFA, GNFA, GMON, or OSCP.
• Automation & Scripting: Practical proficiency with Python, PowerShell, or bash,and experience building automated playbooks within SOAR platforms.
• Cloud & Forensics: Experience with cloud forensics, memory analysis (e.g., Volatility), and disk forensics tools.
• Industry Experience: Background working in regulated or high-threat enterprise environments (e.g., financial services, technology, healthcare).

For more job opportunities, please go to HLB Careers: https://hlb.wd3.myworkdayjobs.com/HLBCareers/

We appreciate your application and will be in touch with shortlisted candidates regarding next steps.

Realise your full potential at Hong Leong Bank by applying now.