Job ID:
Location:Birmingham : Trinity Park : Bi
Position Category:Information Technology
Position Type:Employee Regular
Security Operations Manager
Role Overview
The Security Operations Manager is responsible for building, operating, and continually advancing LRQA’s corporate cyber defence capability in an environment where attackers move fast and automation matters. You will lead a high‑performing internal Security Operations team while overseeing a × outsourced SOC and Incident Response provider.
This is a hands-on operational management role where you will combine threat‑informed detection engineering, incident response coordination, vulnerability management, and AI‑assisted defence. Working closely with IT and senior leadership, your will lead LRQA’s Cyber Security Analysts, y drive the adoption of AI tooling to elevate detection quality, investigation speed, and response outcomes.
Key Responsibilities
Detection & Response Operations
1. Design, mature, and scale LRQA’s detection and response capabilities across endpoints, identity, cloud, and network environments.
2. Own and continuously improve alert logic, response playbooks, escalation workflows, and post‑incident review processes.
3. Ensure threats are detected, triaged, contained, and remediated quickly and consistently.
4. Lead incident response during major security events—coordinating internal teams and managing third‑party IR resources where required.
Team Leadership
5. Manage and mentor a team of internal Cyber Security Analysts.
6. Provide technical direction, operational structure, coaching, and performance development.
7. Build analyst capability, with a focus on modern detection engineering and AI‑assisted investigation techniques.
Third‑Party SOC & Incident Response Management
8. Oversee a × third‑party SOC and IR provider as LRQA’s operational extension.
9. Define and enforce SLAs, KPIs, and escalation procedures.
10. Conduct regular service reviews to ensure high-quality detections, effective response actions, and continual improvement.
11. Be the primary point of accountability for all outsourced SOC and IR outcomes.
AI‑Assisted Defence
12. Drive adoption of AI‑enabled security tooling across detection, investigation, and response workflows.
13. Integrate AI outputs into detection engineering and decision-making, to enhance the team's capability.
14. Establish guardrails to ensure AI recommendations remain explainable, accurate, and aligned to LRQA’s security standards.
Vulnerability Management
15. Own and drive LRQA’s vulnerability management programme, ensuring timely identification, prioritisation, and remediation of weaknesses across endpoints, cloud services, identity systems, and networks.
16. Collaborate with IT, engineering, and cloud teams to ensure remediation activities are tracked, risk‑aligned, and completed within agreed SLAs.
17. Use innovative methods to enhance vulnerability prioritisation, exploit‑likelihood assessment, and risk scoring.
18. Integrate vulnerability intelligence into detection engineering and threat‑modelling activities to strengthen LRQA’s overall defensive posture.
19. Provide clear reporting on vulnerability trends, remediation progress, and systemic risk to senior security leadership.
Metrics & Reporting
20. Define, track, and maintain operational metrics such as MTTD, MTTR, alert fidelity, and incident trends.
21. Provide clear, actionable reporting to senior security leadership.
22. Use data-driven insights to prioritise improvements, influence tooling investment, and strengthen operational resilience.
Cross‑Functional Collaboration
23. Partner with IT, Cloud, Engineering, and Risk teams to remediate vulnerabilities and reduce systemic security risk.
24. Support compliance, audit, and regulatory enquiries relating to security operations.
Required Qualifications
25. Experience leading Security Operations, SOC, or incident response teams.
26. Strong understanding of detection engineering, incident response lifecycle, and modern security monitoring technologies.
27. Proven track record managing third‑party SOC and IR service providers.
28. Familiarity with AI-assisted security tools.
29. Strong leadership, communication, and vendor management skills.
Preferred Qualifications
30. Experience operating in hybrid or cloud‑first environments.
31. Hands-on experience with SIEM, EDR/XDR, and SOAR platforms.
32. Experience mapping detection logic to frameworks such as MITRE ATT&CK.
What Success Looks Like
33. An AI first mindset for improving detection and response.
34. High‑fidelity detections with dramatically reduced alert noise.
35. Fast, predictable, and high‑quality incident triage and response.
36. A motivated internal team supported by a third‑party SOC that delivers outcomes.
37. Reduction in exposures through vulnerability trend analysis and remediation prioritization
Pre-Employment Checks
If you are successful in securing a role with us, we will carry out pre-employment checks in accordance with what is allowed under local law.
These checks will include, (as permitted):- right to work, identification, verification of employment history, education, and criminal records.
We may involve the third-party supplier to run the background checks as needed and your data will be retained for a period as needed for the purpose of employing you.
Your data will be stored in accordance with all relevant privacy legislation.
Please contact us if you have any questions or concerns.