Security Operations Centre​/SOC Team Lead

Security Operations Centre / SOC Team Lead
£58,252 - £68,586 per annum
28.97% Employer pension contribution and more great benefits
Relaxed hybrid and flexible working environment

Location:

Glasgow or Edinburgh

About the Role

Hays' Cyber practice have partnered exclusively with Registers of Scotland (RoS) on the search for a Technical Team Lead within their internal Security Operations Centre. This role will have you leading a team of analysts and working alongside security engineers to develop and automate threat detection and response playbooks, as well as security architects and the wider IT function.

The ideal candidate will have the technical expertise to work on day-to-day operations within a busy SOC, but also will have led SOC teams from a line-management, pastoral leadership, and ITSM perspective, ranging from SIEM use case tuning, to employee appraisals, KPI's and reporting metrics.

About the Organisation

Registers of Scotland (RoS) manages 21 land, property and other legal registers which are a critical asset for the Scottish economy. They aim to provide the best public service for Scotland and are on a mission to make some of the oldest public land registers in the world into some of the most modern.

Registers of Scotland (RoS) is also an award-winning organisation recognised for its technology and innovation and is a world-leading pioneer in land and property registration. Their full-stack teams design, architect, and build all our registration products in-house, and they work to create digital solutions for the people of Scotland. You will get an opportunity to nurture your creativity and develop with RoS through access to the latest data, software engineering and product delivery techniques.

Key Responsibilities

Provide day-to-day line management, coaching, and development of SOC analysts and engineers.
Lead the configuration, tuning, and maintenance of core SOC capabilities including log aggregation, alerting, correlation, threat detection, and response tooling.
Define, track, and report SOC performance metrics and KPIs, ensuring operational efficiency and alignment with organisation objectives.
Manage and mentor SOC team members, setting clear performance objectives, monitoring KPIs, analysing metrics, and driving continuous improvement through coaching, training, and performance reviews.
Collaborate with cyber engineers to develop and automate detection logic and incident response playbooks.
Work with Technical Product Manager and Security Architect to ensure SOC capabilities align with enterprise security architecture and strategy.
Ensure SOC processes are integrated with ITSM systems for effective incident, change, and problem management.
Develop and maintain scenario-based runbooks and technical procedures for incident response.
Engage with project teams to provide security assurance for new and existing services.
Drive continuous improvement in SOC operations, tooling, and team capability.

What We're Looking For

Proven experience in a Security Operations Centre or operational security environment.
Demonstrable experience managing or leading a technical team or function in an enterprise setting.
Strong background in operating and maintaining SOC capabilities such as log management, alerting, threat detection, and incident response tooling.
Experience in incident response, including leading technical investigations and developing response frameworks.
Proficiency in integrating and ope rationalising cyber threat intelligence.
Experience working with ITSM systems to manage and prioritise workloads.
Experience reporting on SOC metrics including SLA/OLA performance, MTTD/MTTR, alert accuracy, and outcome-based security improvements.
Excellent interpersonal and communication skills, with the ability to work effectively across technical and non-technical teams.
Experience developing or implementing vulnerability management tools and processes.
Familiarity with cloud security monitoring and hybrid infrastructure environments.
Knowledge of relevant security frameworks such as NIST CRF, ISO 27001, NCSC CAF, and MITRE ATT&CK.
Experience contributing to or leading SOC maturity assessments or improvement…