Head of Security Operations

Head of Security Operations You will own security operations at Sokin: build it, run it, and grow it. That covers detection strategy, incident response and management, vulnerability management, and identity governance, with day-to-day L1/L2 triage and a chunk of Sentinel content maintenance handled by an outsourced SOC/MSSP. The exact MSSP scope is still being finalized as part of a broader investment case, so you'll help shape the split between what the MSSP owns and what stays in-house as the function matures, rather than inheriting a fixed operating model. This is not a queue-management role, and it's not a role where you sit above an MSSP and relay their output. You direct the detection strategy and hold the MSSP to a quality bar on the content they build and tune, you own L3 investigation and forensics, you run vulnerability management as a program rather than a scanner subscription, and you own identity governance and incident management end to end. Where the MSSP can't cover something - bespoke detections, payments/fraud-specific logic, judgment calls in an active incident - that's you. What you'll do Detection strategy & engineering Define and maintain the detection strategy, mapped to MITRE ATT&CK and iterated against real incidents and threat intel, not left as a static framework exercise Set the standards and review bar for Microsoft Sentinel content (detection rules, analytics, workbooks, Logic Apps playbooks) whether authored by the MSSP or in-house, and own detection-as-code practices - version control, peer review, testing - for that content Own the detections the MSSP can't reasonably build: bespoke, payments/fraud-specific, or identity-driven logic Onboard new log sources and systems into the detection pipeline as the platform evolves, and integrate Defender XDR , Wiz, Cloudflare, Zscaler , and other tooling as it's added, including email/data security telemetry (Defender for O365, DLP) once in scope Consume threat intelligence (feeds, ISACs, sector-specific sources) and translate it into detection and hunting priorities rather than treating it as a subscription nobody reads Build and maintain SOAR automation for alert enrichment, triage, and response actions, so the function scales with the estate rather than with headcount MSSP & outsourced SOC Own the MSSP/outsourced SOC relationship end to end: SLAs, triage quality, playbook tuning, and contract renewal or rescoping as the function's needs change Actively shape the boundary between MSSP and in-house scope as the team and platform mature, rather than treating today's split as permanent Incident response & management Lead incident response: own L3 investigation and forensic analysis across cloud and endpoint, working from MSSP escalations and your own detections Own incident management end to end alongside the CISO - major incident declaration, exec/board notification, and coordination with legal/comms on regulatory notification clocks (GDPR 72-hour, DORA incident classification and reporting) - not just the technical investigation Develop and maintain incident response playbooks and runbooks, and test them regularly through tabletop exercises rather than leaving them filed and unverified Drive post-incident reviews and RCAs, and feed lessons back into detection and playbook updates Vulnerability management & identity governance Own vulnerability management as a program: scanning coverage across cloud, endpoint, and applications, risk-based prioritization, remediation SLAs, and exception handling with named owners Own identity governance within security operations: privileged access monitoring, access anomaly detection, joiner/mover/leaver assurance from a security lens, and identity-related detection coverage across Entra ID/Okta and cloud IAM Metrics, team, and reporting Own MTTD, MTTR, and other operational metrics: baseline them, track them, and drive them down Manage the security operations team, including direct line management of the Security Analyst, and build the hiring/leveling plan as team and MSSP scope evolve Manage SOC systems, tooling, and processes end to end, including budget and licensing conversations with the CISO Support the CISO on incident communication, board/customer reporting, and post-incident reviews What we're looking for Essential: Deep Microsoft Sentinel

Experience

KQL proficient, able to author and critically review detection rules, workbooks, and playbooks, even where day-to-day content maintenance sits with a third party Experience onboarding new data sources into a SIEM and scaling detection coverage as an environment grows Hands-on incident response and digital forensics experience across cloud and endpoint, including running an incident through containment, eradication, and RCA, not just triage Experience sharing ownership of the incident management process: major incident declaration, exec communication, and regulatory notification timelines (GDPR, DORA, or equivalent), typically alongside a CISO or equivalent Applied MITRE ATT&CK knowledge used in detection engineering, not just framework familiarity Experience running or managing vulnerability management as a program: tooling, prioritization, remediation tracking, and reporting Working knowledge of identity governance and access risk (privileged access, JML, IAM/entitlement review) as it applies to security operations Experience managing an MSSP/outsourced SOC relationship, including SLAs, contract or scope negotiation, and holding a third party accountable for quality Experience running tabletop exercises or equivalent IR plan testing Cloud security telemetry: AWS CloudTrail, Azure Monitor, GCP audit logs Strong written communication for incident reports and RCAs aimed at non-technical readers

Nice to Have

Prior people management or mentoring experience in a SOC or detection engineering team Experience with Defender XDR (Defender for Endpoint, Identity, Cloud Apps) Wiz or equivalent CSPM integration into detection pipelines Fintech, payments, or regulated environment background Formal threat intelligence platform experience (beyond consuming feeds) Python or PowerShell for automation Certifications (valued, not required): SC-200, AZ-500, GCIA, GCIH, GCFE, GCFA, or equivalent applied experience

Experience

KQL proficient, able to author and critically review detection rules, workbooks, and playbooks, even where day-to-day content maintenance sits with a third party Experience onboarding new data sources into a SIEM and scaling detection coverage as an environment grows Hands-on incident response and digital forensics experience across cloud and endpoint, including running an incident through containment, eradication, and RCA, not just triage Experience sharing ownership of the incident management process: major incident declaration, exec communication, and regulatory notification timelines (GDPR, DORA, or equivalent), typically alongside a CISO or equivalent Applied MITRE ATT&CK knowledge used in detection engineering, not just framework familiarity Experience running or managing vulnerability management as a program: tooling, prioritization, remediation tracking, and reporting Working knowledge of identity governance and access risk (privileged access, JML, IAM/entitlement review) as it applies to security operations Experience managing an MSSP/outsourced SOC relationship, including SLAs, contract or scope negotiation, and holding a third party accountable for quality Experience running tabletop exercises or equivalent IR plan testing Cloud security telemetry: AWS CloudTrail, Azure Monitor, GCP audit logs Strong written communication for incident reports and RCAs aimed at non-technical readers Prior people management or mentoring experience in a SOC or detection engineering team Experience with Defender XDR (Defender for Endpoint, Identity, Cloud Apps) Wiz or equivalent CSPM integration into detection pipelines Fintech, payments, or regulated environment background Formal threat intelligence platform experience (beyond consuming feeds) Python or PowerShell for automation Certifications (valued, not required): SC-200, AZ-500, GCIA, GCIH, GCFE, GCFA, or equivalent applied experience