Security Operations Centre Manager

Lead, coach and manage the SOC analyst team from L1 through to L3, and the SOC Automation Analyst, across state-based Security Operations Centres, owning performance reviews, career development and succession planning.

Own rostering, scheduling and capacity across a 24x7x365 operation, including roster fairness, fatigue monitoring, mental health awareness and analyst wellbeing.

Refine and drive the analyst development pathway from L1 through to L3 and onward into Platform Engineering, DFIR or engineering specialisations, identifying training needs and knowledge gaps and acting on them.

Ensure day-to-day SOC operations meet SLA, KPI and incident response commitments, and act as the key operational escalation point for the team.

Oversee escalations across the L1 to L3 tiers and coordinate high-severity incident response, shift standups and handoffs.

Own workflow and triage automation and the SOC automation roadmap, agreed with the Head of Managed Services and delivered through the SOC Automation Analyst who reports to you: deciding what gets automated next, reviewing playbook design and logic, and holding delivery and quality.

Maintain SOC processes, SOPs, runbooks and knowledge management aligned to ISO 20000, ISO 27001 and SOC 2, and support audit preparation and evidence rigour.

Drive incident simulation planning, and support post-incident reviews so that what is learned reaches the runbooks.

Act as a senior escalation contact for key MDR clients, and attend client meetings during onboarding, escalation and service review.

Own the operational readiness of new client onboarding into the SOC: tooling, alerting, runbooks and analyst enablement in place before the client goes live.

Ensure the quality, consistency and timeliness of incident documentation, case categorisation, remediation guidance, threat briefs and monthly service reporting.

Drive the evolution of the SOC’s tooling and automation, SIEM, SOAR and EDR, from the operational side, and evaluate emerging technology for what it would genuinely do for triage quality, response time and analyst effort.

Define the SOC’s operational requirements for tooling and workflow, and work with Engineering, DevOps and Platform Engineering to see them delivered.

Hold the peer relationship with the Platform Engineering Manager: weekly operational alignment, joint prioritisation of detection improvements, and integration of client feedback into their roadmap.

Own the SOC side of the feedback loop, ensuring false-positive patterns, noisy alerts and missed-detection observations reach Detection Engineering in a structured, actionable form.

Ensure Platform Engineering output, validated detections, enriched indicators, hunt findings and BAS gap data, is operationalised in the SOC with analysts trained and runbooks updated before the change reaches the queue.

Ensure SOC practice remains compliant with ISO 27001, ISO 20000 and SOC 2, and contribute to internal and external governance and assurance reporting.

Provide regular reporting to the Head of Managed Services on performance, escalations, threats, staffing and initiatives.

Contribute to Triskele Labs’ thought leadership through blog content, Brown Bag talks and internal showcases.

Represent the SOC at industry events and client forums where useful.

Lead by example to uphold the culture, values and technical standards expected of a high-performing SOC.

Application Process

A cover letter addressed to Brad Morgan, Head of Managed Services, is mandatory for this role. Applications without one will not be considered. Tell us about a SOC you have run and one operational problem you fixed that the metrics can prove.

Demonstrated ownership of a workflow and triage automation capability: deciding what to automate, reviewing playbook design, and directing the person building it.

Demonstrated ability to operate as a peer to an engineering or platform function without absorbing or duplicating its remit.

Strong working knowledge of security frameworks including MITRE ATT&CK, NIST and ISO.

Experience with our stack or equivalent: Microsoft Sentinel, Splunk, Rapid7 InsightIDR, Elastic, Microsoft Defender, CrowdStrike, and Shuffle or an equivalent SOAR platform.

Hands-on SOAR playbook build experience, or the ability to review playbook logic in detail rather than only its outcomes.

Experience managing geographically distributed or state-based operational teams.

Exposure to ISO certification audits or SOC-CMM assessment.

Experience building or operating an analyst development pathway and moving people through it.

Certifications such as GCIA, GCIH or equivalent SOC leadership credentials, and experience with reporting tools such as Power BI.

A bachelor’s degree in cyber security or information technology, or demonstrated equivalent experience.

The role is full time, Monday to Friday in our Melbourne office.