It isn’t a real metric yet. This team wants to make it one.
A large Australian organisation is looking for a SOC Manager to lead its security operations, own threat exposure end to end, and build an agentic SOC. A managed provider handles L1 and L2, so your team can focus on the escalations that matter and the work that stops incidents happening in the first place.
What you’ll be doing
- Leading a team of three, growing to five as you hire a Senior Detection Engineer and a Senior Incident Responder
- Driving the agentic SOC roadmap, automating Tier 1 and Tier 2 triage with SOAR and AI agents to cut MTTR and alert fatigue
- Owning continuous threat exposure management, feeding vulnerability and posture data into the SecOps platform so every alert comes with context
- Building automated playbooks with IT for vulnerability ticketing, ownership and SLA tracking
- Correlating live vulnerabilities with threat actor behaviour, and deploying detections for unpatched systems
- Acting as incident commander when a major incident hits
- Holding the managed provider to strict SLAs as the team moves to an agentic model
What you’ll bring
- 5+ years in cyber security operations, including time leading a SOC or operations team
- Hands-on experience with cloud-native SecOps platforms and agentic SOC principles
- Experience moving a team from vulnerability scanning to context-aware CTEM
- Solid working knowledge of SIEM, SOAR, CTI, detection engineering and incident response
- Experience managing a managed security provider
- An ownership mindset: you see a problem and bring a solution
The team
- Flat structure, low egos and a lot of honesty
- People ask for help, share what they know and back each other
- You’ll report to the CISO, who’s openly said the team is smarter than they are
- Real investment in development: a personal plan for every team member, funded training, memberships and conference
The practical bits
- Permanent, full time
- Hybrid, Sydney, 2 days per week onsite in an ideal world
- $220k to $240k base plus super, plus bonus
Already automated triage, or built a CTEM program from scratch? I’d love to hear how you did it.