Deputy Head of Security Operations Center (SOC)

The Deputy Head of Security Operations Center (SOC) is responsible for leading the bank's day-to-day Security Operations Center (SOC) activities, ensuring effective threat monitoring, incident detection, response, and continuous enhancement of cyber defense capabilities. Working closely with the Head of SOC, this role provides technical and operational leadership across security monitoring, detection engineering, threat hunting, incident response, and Managed Security Service Provider (MSSP) governance while ensuring compliance with regulatory requirements and industry best practices.

Key Responsibilities

• Lead the day-to-day operations of the Security Operations Center (SOC), ensuring continuous monitoring, threat detection, incident triage, and timely response to cybersecurity events.
• Oversee the design, optimization, and management of enterprise security platforms, including SIEM, SOAR, EDR, NDR, and UEBA, to enhance threat visibility, automation, and operational efficiency.
• Drive the development and continuous improvement of threat detection use cases, security monitoring rules, and response playbooks aligned with the MITRE ATT&CK framework and emerging cyber threats.
• Direct incident response activities, providing technical leadership for cyber investigations, containment, eradication, recovery, root cause analysis, and post-incident remediation.
• Manage and govern Managed Security Service Providers (MSSPs), ensuring service level compliance, operational excellence, and effective collaboration with internal cybersecurity, infrastructure, and technology teams.
• Lead proactive threat hunting initiatives, leveraging cyber threat intelligence to identify advanced threats, strengthen detection capabilities, and improve the bank's overall cyber resilience.
• Ensure compliance with regulatory requirements, including BNM RMiT, and support internal and external audits through effective governance, documentation, reporting, and remediation of audit findings.
• Mentor and develop SOC analysts and engineers, manage cybersecurity improvement projects, and drive continuous enhancement of SOC processes, automation, operational performance, and cyber defense maturity.

Key Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, or a related technical discipline. A Master's degree is an added advantage.
• Minimum 8–10 years of experience in cybersecurity, with at least 3–5 years leading Security Operations Center (SOC), Cyber Defense, or Incident Response teams within the banking or financial services industry.
• Strong hands-on expertise in enterprise security technologies, including SIEM, SOAR, EDR, NDR, UEBA, threat intelligence platforms, and security monitoring tools such as Splunk, QRadar, Microsoft Sentinel, CrowdStrike, SentinelOne, or Palo Alto Cortex XSOAR.
• Deep understanding of cybersecurity frameworks and methodologies, including MITRE ATT&CK, NIST Incident Response Framework, Cyber Kill Chain, digital forensics, threat hunting, malware analysis, and incident management.
• Proven experience managing Managed Security Service Providers (MSSPs), vendor performance, service level agreements (SLAs), and enterprise security operations in a highly regulated environment.
• Strong knowledge of banking cybersecurity regulations and standards, including BNM RMiT, PCI-DSS, SWIFT CSP, ISO/IEC 27001, and other applicable regulatory requirements.
• Professional certifications such as CISSP, CISM, GCIA, GCIH, GMON, GCFA, GCTI, or equivalent cybersecurity certifications are highly desirable.
• Excellent leadership, stakeholder management, communication, and project delivery skills with the ability to lead technical teams, manage high-severity cyber incidents, influence cross-functional stakeholders, and drive continuous improvements in cyber defense operations.