The SOC Manager leads the Security Operations Center's people, processes, and technology to detect, investigate, and respond to cybersecurity threats across the organization on a 24x7x365 basis. This role owns the SIEM/SOAR platform strategy, drives proactive threat hunting and intelligence integration, and ensures the SOC operates with strong governance, automation, and continuous improvement. The SOC Manager acts as a key crisis leader during security incidents and serves as a trusted communicator to technical teams and executive stakeholders alike.
Key Responsibilities
Security Operations Leadership
Own and manage 24x7x365 SOC operations, ensuring continuous monitoring, detection, and response coverage across all shifts, including nights, weekends, and holidays.
Design and maintain shift schedules, staffing models, and follow-the-sun or on-call rotations to guarantee round-the-clock coverage without gaps.
Lead the SOC's daily operations, including shift coverage, escalation paths, and performance metrics (MTTD, MTTR, alert volume/quality).
Define and continuously improve SOC processes, playbooks, and standard operating procedures.
Set strategic direction for the SOC in alignment with overall security and business objectives.
Incident Response & Crisis Management
Serve as incident commander for high-severity security incidents, coordinating containment, eradication, and recovery.
Maintain and regularly test the incident response plan, including tabletop exercises and post-incident reviews.
Coordinate cross-functional crisis response with IT, legal, communications, and executive leadership as needed.
Threat Detection & Hunting
Direct proactive threat hunting programs to uncover hidden or emerging threats not caught by existing detections.
Continuously refine detection logic and use cases based on the evolving threat landscape and lessons learned from incidents.
SIEM/SOAR Management
Own the SIEM and SOAR platforms end to end, architecture, content development, tuning, and health monitoring.
Partner with engineering to ensure adequate log source coverage, data quality, and retention.
Threat Intelligence
Integrate internal and external threat intelligence into detection engineering, risk assessments, and briefings.
Track relevant threat actors, TTPs, and campaigns to inform SOC prioritization.
Cybersecurity Risk Management
Assess and communicate operational security risks, partnering with stakeholders on remediation prioritization.
Support exception processes with clear, well-documented rationale.
Security Automation
Drive automation initiatives (SOAR playbooks, scripting, orchestration) to reduce manual effort and improve response times.
Identify opportunities to eliminate repetitive analyst tasks through tooling and process redesign.
People & Stakeholder Management
Hire, coach, and develop SOC analysts and engineers; manage performance, staffing, and shift schedules.
Build strong partnerships with IT, engineering, legal, and compliance stakeholders.
Security Governance and Compliance
Ensure SOC operations align with internal policy, regulatory requirements, and audit/compliance obligations.
Maintain accurate documentation, metrics, and evidence to support audits and governance reviews.
Communication
Deliver clear, concise incident reports, summaries, and operational updates to technical and non-technical audiences.
Represent the SOC in cross-functional meetings and executive briefings.
Core Competencies
Security Operations Leadership
Directs the day-to-day operation of a 24x7x365 Security Operations Center (SOC), setting priorities, shift structures, and performance standards to ensure continuous, high-quality monitoring and defense coverage around the clock.
Incident Response & Crisis Management
Leads end-to-end incident response for security events, coordinating containment, eradication, and recovery efforts, and acting as incident commander during high-severity or crisis-level events.
Threat Detection & Hunting
Oversees proactive threat hunting activities and continuously improves detection logic to identify adversary behavior, novel attack techniques, and gaps in existing coverage.
SIEM/SOAR Management
Owns the SOC's SIEM and SOAR platforms end to end, use-case development, correlation rule tuning, playbook design, and platform health, to maximize detection fidelity and response speed.
Threat Intelligence
Integrates threat intelligence feeds and analysis into SOC operations to inform detection priorities, risk assessments, and proactive defense measures against relevant threat actors.
Cybersecurity Risk Management
Evaluates and communicates operational security risk, working with stakeholders to prioritize remediation and ensure risk decisions are made with accurate, timely information.
Security Automation
Champions automation of repetitive SOC tasks and response workflows to reduce mean time to detect/respond and free analyst capacity for higher-value investigative work.
People & Stakeholder Management
Manages, mentors, and develops SOC analysts and engineers while building strong working relationships across IT, engineering, legal, and executive stakeholders.
Problem Solving and Decision Making
Makes sound, timely decisions under pressure and ambiguity, applying structured problem-solving to complex, evolving security situations.
Security Governance and Compliance
Ensures SOC processes align with security policies, regulatory requirements, and audit/compliance obligations, maintaining thorough documentation and control evidence.
Good Written and Verbal Communication
Communicates technical findings and risk clearly to both technical and non-technical audiences, including executive reporting and cross-functional coordination.
Required
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience.
5+ years of experience in security operations, with at least 2–3 years in a leadership or management capacity.
Hands-on experience administering SIEM/SOAR platforms.
Demonstrated experience leading incident response for medium-to-high severity security events.
Strong understanding of threat intelligence, threat hunting methodologies, and the MITRE ATT&CK framework.
Excellent written and verbal communication skills, including experience presenting to executive audiences.
Prior experience managing or operating within a 24x7x365 SOC environment, including shift-based staffing models and on-call/escalation rotations.
Willingness to be available for off-hours escalation and to periodically work outside standard business hours in support of round-the-clock operations.
Preferred
Industry certifications such as CISSP, CISM, GCIH, GCIA, or equivalent.
Experience with security automation/scripting (Python, PowerShell) and SOAR playbook development.
Experience operating within a regulated or compliance-driven environment (e.g., SOX, PCI-DSS, ISO 27001).
Background in vulnerability management, risk management, or governance functions.
Benefits:
- Hybrid working arrangements (2/3 days in the office)
- Annual performance-related bonus
- 6x Flexi Anyday: knock 2.5 hours off your day on any workday
Engaging, fun & inclusive culture: check out the MRI Software APAC Insta feed and stories!
About Us
From the day we opened our doors, MRI Software has built flexible, game-changing real estate software that powers thriving communities and helps make the world a better place to live, work and play. Fulfilling that mission is only possible because of one thing: exceptional people. People like you!
Our people-first approach to PropTech is defining a new industry standard for client experiences that, quite frankly, can’t be duplicated. Experiences that deliver real value every day. And we know those experiences begin with our people.
We believe MRI is more than just a workplace; it’s a connected community of people who truly feel they belong. Whether we’re investing in employee resource groups or providing tailored resources for each person to reach their full potential, we’re passionate about creating a work environment that makes you excited to show up every single day.
At MRI, one of our core values is to strive to amaze. From the intelligent solutions we create to the culture we cultivate, that’s our goal every day. Because that’s what industry leaders do. Whether you’re joining as a new Pride member or rejoining us after a short time away, your talent is vital to us, our partners and our clients.
Amazing growth requires amazing employees. Are you up to the challenge?
We know confidence gap and imposter syndrome can get in the way of meeting remarkable candidates, so please don’t hesitate to apply. We’d love to hear from you!
MRI is proud to be an inclusive employer. We welcome and celebrate diversity across all backgrounds, including ethnicity, religion, sexual orientation, gender identity, disability, age, military, veteran status and more.
We believe that Belonging is a direct result of Diversity, Equity, and Inclusion. Those values are woven into the fabric of who we are and are foundational to our continued success. Come and see for yourself!
Skills Required
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience
- 5+ years of experience in security operations, including 2-3 years in leadership or management
- Hands-on experience administering SIEM and SOAR platforms
- Experience leading incident response for medium-to-high severity security events
- Strong understanding of threat intelligence, threat hunting methodologies, and the MITRE ATT&CK framework
- Excellent written and verbal communication skills, including executive presentation experience
- Experience managing or operating within a 24x7x365 SOC, including shift staffing and on-call or escalation rotations
- Willingness to support off-hours escalations and periodically work outside standard business hours
- Industry certification such as CISSP, CISM, GCIH, GCIA, or equivalent
- Experience with security automation, Python or PowerShell scripting, and SOAR playbook development
- Experience in a regulated or compliance-driven environment, such as SOX, PCI-DSS, or ISO 27001
- Background in vulnerability management, risk management, or governance functions
MRI Software Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about MRI Software and has not been reviewed or approved by MRI Software.
-
Retirement Support — A 401(k)/Roth plan with a strong company match stands out as a competitive element of the package. Match design is portrayed as generous relative to many tech peers.
-
Parental & Family Support — Paid parental leave for birth and non-birth parents, compassionate leave, and lactation/travel support indicate robust family benefits. These offerings provide substantial support during major life events.
-
Leave & Time Off Breadth — A minimum of four weeks PTO, company holidays, volunteer time, and Flexi Anydays reflect a broad time-off offering. Hybrid and flexible work options complement the time-off structure for work-life balance.
MRI Software Insights
What We Do
MRI Software is a leading provider of real estate software solutions that transform the way communities live, work and play. MRI’s comprehensive, flexible, open and connected platform empowers owners, operators and occupiers in commercial and residential property organizations to innovate in rapidly changing markets. MRI has been a trailblazer in the PropTech industry for over five decades, serving more than two million users worldwide. Through leading solutions and a rich partner ecosystem, MRI gives real estate companies the freedom to elevate their business and gain a competitive edge. For more information, please visit http://www.mrisoftware.com.
.png)
