Security Operations Manager – Threat Detection & Response

About the role

As part of EY's cyber security team, the Threat Detection & Response Operations Manager will lead operations and delivery for TDR engagements, providing end‑to‑end security incident investigation support and ensuring client SLAs and KPIs are met.

Key responsibilities

• Oversee detection, reporting and response processes for security incidents, ensuring the SOC team manages incidents effectively.
• Manage security tools and technologies (SIEM, EDR, NSM) to ensure proper configuration, maintenance and threat monitoring.
• Lead the Security Operations Center, monitor client networks, and ensure Service Level Agreements are defined, tracked and met.
• Provide technical leadership, advise junior team members, and revise standard operating procedures as needed.
• Identify opportunities to improve security monitoring, automate daily SOC tasks and convey complex technical concepts to both technical and non‑technical audiences.

Required profile

• Minimum 10 years of hands‑on experience operating, implementing or designing SIEM solutions.
• B.Tech/B.E. degree with strong technical skills and ability to work in client time zones.
• Strong verbal and written English communication, critical thinking and interpersonal skills.
• Relevant certifications such as CISM, CEH, CISSP, GCIH, GIAC, SABSA or TOGAF are a plus.

Required skills

• Microsoft Sentinel and Splunk SIEM platforms.
• Endpoint Detection & Response tools (Carbon Black, Microsoft Defender, CrowdStrike).
• Network monitoring solutions (Fidelis XPS, ExtraHop).
• Threat Intelligence, cloud security, IoT/OT knowledge.
• RegEx, Perl scripting and SQL query language.

What we offer

• Opportunities to work on inspiring, meaningful cyber‑security projects for global clients.
• Support, coaching and feedback from experienced colleagues.
• Individual development plans and flexible career progression.
• Access to a diverse, inclusive environment across more than 150 countries.