SOC Manager - IN

Overview

Lead Rackspace's 24x7 Managed Security Services SOC, guiding a multidisciplinary team of security analysts and engineers across threat detection, incident investigation and response, and vulnerability management in customer environments. This is a hands-on technical leadership role.

What you'll do

• Lead, manage and mentor SOC analysts, security engineers and technical specialists across L1/L2/L3 functions.
• Oversee 24x7 security operations, shift coverage, workload distribution, incident escalation and operational readiness.
• Provide technical direction and guidance during complex investigations and security incidents.
• Conduct technical reviews, knowledge-sharing sessions, coaching and skills development.
• Drive analyst productivity, operational quality and team performance.
• Lead technical investigations into critical and high-severity incidents, including malware, ransomware, compromised identities, unauthorized access, suspicious network activity and cloud security threats.
• Act as security incident lead for P1/P2 incidents, coordinating investigation, containment, remediation guidance and security recovery validation.
• Perform or oversee advanced analysis of endpoint telemetry, security logs, network events, indicators of compromise and attacker techniques.
• Guide analysts in threat hunting, incident correlation, root cause analysis and forensic evidence preservation.
• Coordinate with infrastructure, network, cloud, IAM, application and customer security teams to facilitate incident resolution.
• Ensure timely customer communication, incident updates, escalations and post-incident reporting.
• Maintain and improve incident response playbooks and investigation procedures.
• Oversee security operations across the RCDC portfolio, including Microsoft Sentinel and Elastic Security (XDR/SIEM), CrowdStrike Falcon and Microsoft Defender for Endpoint (EDR), Qualys (VMDR), Cloudflare WAF and DDoS protection (Edge Security), Palo Alto Networks, Fortinet and native cloud controls (Managed Network Security), CloudSEK (MDRM/External Threat Monitoring), and CSPM/CNAPP technologies such as Prowler and Upwind.
• Serve as senior technical point of contact for customer CISOs, security leaders and technical stakeholders; lead technical incident discussions, operational reviews, security workshops and customer escalations.
• Explain security incidents, risks, investigation findings and remediation recommendations to technical and non-technical audiences.
• Ensure delivery against agreed SLAs, KPIs, customer commitments and security service objectives.
• Oversee customer onboarding, monitoring coverage, policy configuration and operational handover.
• Identify recurring customer issues and recommend improvements to security controls, detections and operational processes.
• Oversee detection rule development, tuning, alert correlation and false-positive reduction.
• Promote proactive threat hunting using MITRE ATT&CK, threat intelligence and adversary TTPs.
• Develop and improve security investigation and response runbooks.
• Identify opportunities for SOAR automation, AI-assisted investigation and pre-approved response actions, ensuring authorization, testing, logging and change-control procedures are followed.
• Oversee vulnerability assessment operations, scanning coverage and agent health monitoring; ensure critical vulnerabilities are prioritized, communicated and tracked.
• Coordinate remediation with infrastructure, cloud, application and customer teams; monitor vulnerability aging, overdue findings, risk exceptions and remediation validation.
• Maintain SOC operational standards, investigation quality, documentation and service delivery controls.
• Track operational KPIs such as incident response compliance, investigation quality, monitoring coverage, customer escalations and service improvement.
• Lead security incident reviews, root cause analysis and corrective action planning.
• Maintain operational runbooks, escalation procedures and knowledge documentation; support service enhancements and operational readiness for new offerings.

What you'll need

• 10–15 years of cybersecurity experience, including approximately 4–6 years in SOC leadership, incident response or security operations management.
• Proven experience managing a 24x7 SOC or MSSP security operations environment.
• Strong hands-on experience in security incident investigation, threat detection, incident response and log analysis.
• Practical expertise in at least one major SIEM platform, preferably Microsoft Sentinel or Elastic Security.
• Strong experience with enterprise EDR technologies such as CrowdStrike Falcon or Microsoft Defender for Endpoint.
• Working knowledge of vulnerability management platforms, preferably Qualys.
• Understanding of cloud security across Azure, AWS and GCP.
• Knowledge of network security, firewalls, WAF, identity security and endpoint protection.
• Experience with MITRE ATT&CK, NIST incident response guidance and security operations best practices.
• Strong analytical, troubleshooting and problem-solving capabilities.
• Excellent customer communication, stakeholder management and presentation skills.
• Experience handling major security incidents and coordinating multidisciplinary technical teams.
• Demonstrated ability to mentor engineers and develop high-performing technical teams.

Nice to have

• Experience working in an MSSP or managed security services organization supporting multiple enterprise customers.
• Exposure to Cloudflare, Palo Alto Networks, Fortinet, CloudSEK, CSPM or CNAPP technologies.
• Experience with SOAR platforms, security automation, scripting and AI-assisted SOC operations.
• Experience supporting customer technical workshops, solution evaluations and new service onboarding.
• Familiarity with ITIL incident, problem and change management processes.
• Relevant certifications such as CISSP, CISM, GCIH, GCIA, GSOC, SC-200, or equivalent practical expertise.
• Bachelor's degree in Computer Science, Information Security, Engineering or a related discipline, or equivalent professional experience.

Details

• Location: Gurgaon, India.