Strong analysts are often promoted into SOC management and then find that the job is mostly people, money, service levels and difficult conversations, with very little time at a console. The security operations manager owns how well the SOC detects and responds: staffing a 24x7 rota, keeping analysts long enough to get good, choosing what to measure, managing providers and tools, and representing the SOC to the CISO and the business. This guide covers what the role involves, the skills that matter, the routes from shift lead or incident response into management, certifications that help and where the role leads. It is written for senior analysts and shift leads planning the move and for new SOC managers in their first year. SOC design itself is covered in the SOC Guide; wider career routes are in the Cybersecurity Careers Guide.
Key takeaways
- The product is a service, not a tool estate. A SOC manager is judged on whether incidents are found and handled within agreed times, and on whether the business trusts the SOC's calls.
- People are the main lever. MITRE's SOC guidance tells managers to "Plan for turnover and build a pipeline to hire"; retention, rotation and growth paths decide how good the SOC becomes.
- Authority must be written down. A charter approved by leadership that states scope and who may isolate a host or disable an account prevents the slowest arguments during incidents.
- Metrics shape behaviour. Measuring closure counts alone pushes analysts towards fast dismissal; pair speed with quality and coverage measures.
- Technical credibility still matters. UK employers told DSIT that finding people who are technically skilled and can manage people is very hard, which is exactly the gap this role fills.
What the role does
MITRE's 11 Strategies of a World-Class Cybersecurity Operations Center describes SOC operations management as executing the day-to-day functions of running a SOC "including financial and personnel management", alongside strategy and process improvement towards a future state. Its eleven strategies are a fair job description for the manager: know what you are protecting and why; give the SOC the authority to do its job; build a structure to match organisational needs; hire and grow quality staff; prioritise incident response; illuminate adversaries with cyber threat intelligence; select and collect the right data; leverage tools to support analyst workflow; communicate clearly, collaborate often and share generously; measure performance to improve performance; and expand SOC functionality.
In the NICE Framework (components v2.2.0, April 2025) the closest work role is OG-WRL-014 Systems Security Management, managing cybersecurity for a programme, organisation, system or enclave, with OG-WRL-003 Cybersecurity Workforce Management covering staffing and training and PD-WRL-003 Incident Response covering the operational core. The US Bureau of Labor Statistics groups IT security managers within computer and information systems managers, whose duties include setting up processes to detect, prevent and reduce IT security threats, determining staffing needs and negotiating with and monitoring vendors.
| Area | What the manager owns | Typical evidence of doing it well |
|---|---|---|
| Service | Scope, hours, severity definitions, response time targets, escalation paths | A published service catalogue and charter; incident reviews that show targets were met or explain why not |
| People | Hiring, rota, training plans, career paths, performance, wellbeing | Stable attrition, filled shifts without chronic overtime, internal promotions |
| Detection quality | Use case backlog, tuning, coverage of priority threats with detection engineering | Falling false positive rates, ATT&CK coverage reviewed quarterly |
| Incident handling | Major incident process, playbooks, exercises, links to IT, legal and communications | Exercise reports with actions closed; tested runbooks |
| Tools and data | SIEM, EDR, SOAR and log source onboarding, licence and storage costs | Log source inventory with gaps, cost per GB tracked, automation removing toil |
| Providers | MSSP or MDR contracts, co-managed boundaries, service reviews | Clear responsibility matrix, provider performance reported monthly |
| Reporting | Monthly reporting to the CISO, risk committees and auditors | Metrics tied to business risk rather than raw alert counts |
A manager's week
- Daily: review overnight incidents and handovers, unblock escalations, check shift cover.
- Weekly: detection and tuning review with engineering, open incident actions, provider call, one-to-ones.
- Monthly: metrics pack to the CISO, rota planning, budget and licence tracking, a tabletop or purple team exercise.
- Quarterly: coverage review against the threat model, training plan refresh, provider service review, roadmap update.
Core skills and tools
| Skill | What good looks like | How to build it before the promotion |
|---|---|---|
| Incident command | Runs a major incident calmly: roles, timeline, decisions logged, communication cadence | Act as incident lead on medium incidents; see the Incident Response Guide |
| Workforce planning | Calculates seats per 24x7 position, plans leave, training and attrition, and justifies headcount | Build a rota model; see the SOC Staffing and Shift Models Guide |
| Metrics | Chooses a small set of measures that drive the right behaviour and explains them to executives | Draft a monthly pack; see the Security Operations Metrics Guide |
| Budget and commercial | Understands SIEM ingest pricing, EDR licensing, provider contracts and the cost of a seat | Shadow a renewal and a provider service review |
| Coaching and feedback | Regular one-to-ones, clear expectations, honest performance conversations | Mentor two analysts formally as a shift lead |
| Stakeholder management | Agrees containment authority with IT, explains risk to business owners, handles audit requests | Present incident reviews to non-security audiences |
| Technical judgement | Can read a timeline, challenge a conclusion and know when a detection is weak | Keep investigating occasionally; review a sample of closed cases each month |
| Automation and AI oversight | Decides which triage steps to automate and how AI outputs are checked | Own one SOAR playbook; see the AI SOC Guide |
Metrics that work together: mean time to triage and to contain by severity; false positive rate per rule; the share of alerts closed with a recorded reason; ATT&CK coverage on priority techniques; log source health; and analyst attrition and overtime hours. MITRE frames the aim of measurement as showing "what is working well, and where to improve", and warns that not all measures produce positive outcomes.
Where identity fits
Many of the SOC's highest-severity cases are identity cases: compromised accounts, MFA fatigue, token theft, privilege changes and service accounts or API keys used from unexpected places. The manager decides who in the SOC may disable an account, revoke sessions or rotate a machine credential at 3am, and makes sure identity logs from the IdP, PAM and secrets platforms are actually collected. See the ITDR Guide.
Routes into the role
- Shift lead or team lead: the most common route; you already run handovers, the queue and coaching for a shift.
- Incident response lead: brings major incident command and stakeholder communication.
- MSSP or MDR service delivery manager: brings contracts, service levels and multi-client reporting; add depth on a single estate.
- IT operations or NOC management: brings rota, ITIL-style service management and vendor handling; add security depth, typically by spending time as a senior analyst first.
- Building a SOC: in smaller organisations the first SOC manager often builds the function. See the Building a SOC from Scratch Guide.
Market context: DSIT's Cyber security skills in the UK labour market 2026 found Security Manager roles were the largest single group of core cyber job postings in 2025 at 27%, up from 22% in 2024, and quoted one large firm: "To get someone that is technically skilled but also can manage people is virtually impossible." DSIT gives no SOC manager salary figure; the mean advertised salary across core cyber roles was £60,800 in 2025. In the US, BLS reports a median of $175,140 (May 2025) for computer and information systems managers, usually requiring five years or more of related experience; that occupation is far broader than SOC management.
Certifications that help
For managers, certifications mostly signal breadth and management knowledge; your incident record and team outcomes matter more. Check current outlines and fees with each body. The table is descriptive, not a ranking.
| Awarding body | Certification | Relevance | Facts checked 27 October 2026 |
|---|---|---|---|
| GIAC | GIAC Cyber Incident Leader (GCIL) | Managing incidents and leading an incident management team; building IM teams and improving IM processes | 75 questions, 2 hours, 70% to pass |
| ISACA | CISM | Domains: Information Security Governance, Information Security Risk Management, Information Security Program, Incident Management | Exam US$575 members, US$760 non-members |
| ISC2 | CISSP | Broad security management credibility, often requested for management roles | See the CISSP Certification Guide |
| GIAC | GIAC Certified Incident Handler (GCIH) | Hands-on incident handling depth for managers from a non-IR background | See the GIAC GCIH Guide |
| Various | Service management (for example ITIL) and people management qualifications | Service levels, change and problem management, leadership | Provider specific |
See the CISM Certification Guide for exam detail.
Progression
| Next role | What changes | Build this as SOC manager |
|---|---|---|
| Head of security operations or detection and response | Owns SOC, IR, threat intelligence and detection engineering together | Multi-team planning, budget ownership, roadmap |
| Director of security operations at a provider | Multiple client SOCs, commercial targets | Service economics, contract negotiation |
| Deputy CISO or CISO | Whole security programme, board reporting, risk ownership | Risk language, governance, board communication. See the Path to CISO Career Guide |
| Resilience or crisis management lead | Business continuity, crisis communication across all incident types | Exercise programmes, executive crisis teams |
Framework mapping
| Framework | Where SOC management sits |
|---|---|
| NICE Framework v2.2.0 | OG-WRL-014 Systems Security Management, OG-WRL-003 Cybersecurity Workforce Management, PD-WRL-003 Incident Response |
| NIST CSF 2.0 | DE.CM Continuous Monitoring, DE.AE Adverse Event Analysis, RS.MA Incident Management, GV.RR Roles, Responsibilities, and Authorities |
| NIST SP 800-53 Rev. 5 | IR-4 Incident Handling, IR-8 Incident Response Plan, SI-4 System Monitoring |
| CIS Controls v8.1 | Control 8 Audit Log Management, Control 13 Network Monitoring and Defense, Control 17 Incident Response Management |
| Maturity | See the SOC Maturity Model |
Common failure patterns for new SOC managers
- Staying the best analyst: taking the hardest cases yourself while one-to-ones, rota and budget slip.
- Measuring volume: rewarding alerts closed per shift, which trains dismissal rather than investigation.
- Unwritten authority: no agreement on who may isolate production hosts or disable executive accounts, discovered mid-incident.
- Ignoring attrition until it happens: no growth path, so the best analysts leave after two years.
- Buying tools to fix process: a new platform onboarded onto the same untuned use cases.
- Unclear provider boundaries: MSSP and in-house teams each assuming the other is handling an alert.
Practitioner checklist
- Lead at least three incidents as incident commander before applying.
- Build a 24x7 rota model including leave, training and attrition.
- Draft a SOC charter that states scope, hours and containment authority.
- Choose five to seven metrics that balance speed, quality, coverage and people.
- Learn your SIEM and EDR cost model and the provider contract terms.
- Set up regular one-to-ones and a written growth path for each analyst level.
- Agree who may disable accounts and rotate machine credentials out of hours.
- Pick one management or incident leadership certification that fills your gap.
Standards and references
- MITRE: 11 Strategies of a World-Class Cybersecurity Operations Center
- NIST: NICE Framework current versions
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- GIAC: Cyber Incident Leader (GCIL)
- ISACA: CISM certification
- DSIT: Cyber security skills in the UK labour market 2026
- US Bureau of Labor Statistics: Computer and Information Systems Managers
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · SOC Guide · SOC Staffing and Shift Models Guide · SOC Analyst Career Guide · Path to CISO Career Guide