Manager, Cyber Security Operations
Listed on 2026-01-15
-
IT/Tech
Cybersecurity, Security Manager
Join to apply for the Manager, Cyber Security Operations role at recruit
22
6 days ago Be among the first 25 applicants
This range is provided by recruit
22. Your actual pay will be based on your skills and experience — talk with your recruiter to learn more.
$/yr - $/yr
Recruit
22 is seeking an experienced and strategic Cyber Security Operations Manager to join our large healthcare client. The Security Operations Leader is responsible for overseeing day‑to‑day security operations and ensuring the effective detection, investigation, containment, and remediation of cyber threats impacting the enterprise. This role manages a team of analysts, drives operational readiness, and strengthens the organization's security posture through continuous improvement, technical leadership, and cross‑department collaboration.
Must be capable of operating independently, demonstrating advanced critical‑thinking skills, strong analytical capabilities, sound judgment under pressure, and the ability to comprehend and address complex technical and organizational challenges without relying solely on predefined checklists or prescriptive workflows.
- Oversee day‑to‑day SOC operations across cloud, on‑premises, endpoint, and application environments.
- Provide technical direction and operational leadership to SOC analysts.
- Ensure all security events and incidents are managed consistently, accurately, and in alignment with organizational priorities.
- Lead, mentor, and coach SOC analysts to support skill development, analytical capability, and operational maturity.
- Assist in performance evaluations, guide career progression, and foster a culture of accountability and high performance.
- Establish expectations for independent analysis, strong reasoning, and effective decision‑making by team members.
- Direct and coordinate incident response activities, including investigation, containment, and remediation.
- Provide real‑time guidance to analysts during high‑severity incidents and ensure timely, well‑documented.
- Serve as an escalation point for complex investigations or ambiguous threat scenarios requiring executive decision‑making.
- Evaluate and enhance detection coverage, analytic depth, and SOC visibility.
- Partner with threat intelligence, engineering, and architecture teams to refine detection logic and improve response capability.
- Ensure SOC maintains awareness of emerging threats and incorporates relevant intelligence into operations.
- Coordinate with IT Infrastructure, Networking, Application, Clinical, and Cybersecurity Architecture teams to support remediation activities.
- Collaborate closely with Compliance and HR during internal investigations requiring log analysis, evidence gathering, or technical validation.
- Support audit engagements, including SOC2 and regulatory requirements (e.g., HIPAA, NIST CSF), by providing evidence, insights, and technical expertise.
- Develop, maintain, and continuously improve SOC playbooks, incident response procedures, and operational documentation.
- Identify and eliminate operational bottlenecks, introducing process efficiencies based on experience and analytical insight.
- Oversee SOC technologies including SIEM, EDR/XDR, SOAR, threat intelligence platforms, and related detection or investigation tooling.
- Ensure platform configurations, alerting logic, and integrations remain optimized for accuracy, visibility, and speed.
- Track SOC KPIs and operational metrics to effectively communicate security posture, incident volume, and response effectiveness.
- Deliver concise, executive‑ready reporting on incidents, trends, risks, and opportunities for improvement.
- Identify opportunities to leverage AI and automation to improve SOC efficiency, reduce manual workload, and strengthen response capability.
- Lead AI‑driven security solutions and responsible AI governance (frameworks, adoption, alignment with…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).