SOC Manager

The work

Assess security operations from detection through containment, identifying gaps in triage, escalation, and response. This flexible remote consulting contract is designed for professionals with practical SOC or security operations experience.

Responsibilities

• Check alerts, triage processes, and escalation routes for consistency and effectiveness.
• Assess response actions throughout the incident lifecycle for completeness, correctness, and quality.
• Find missing log coverage, weaknesses in detection logic, and gaps in containment procedures.
• Summarize incident patterns, recurring weaknesses, and operational delays in organized reports.
• Review response playbooks for clear instructions, correctness, and practical feasibility.
• Contribute to repeated assessments of SOC maturity, responsiveness, and operational discipline.

Background and skills

You need experience in SOC operations, cybersecurity operations, or leading incident response. Deep knowledge of detection engineering, response processes, and the full incident lifecycle is required.

The role calls for strong analytical writing, the ability to turn complex findings into usable documentation, and a practical eye for processes that are incomplete or underperforming.

Additional strengths

Helpful experience includes SIEM, EDR, and cloud detection tools; SOC maturity reviews; red or purple team work; and building or auditing response playbooks across large operations.

Working arrangements

This is a remote hourly contract with flexible working hours. Work is organized around independent assignments and a flexible schedule. Tasks are clearly defined, with the possibility of continuing engagements as assessments expand.