Lead / Principal Cyber Engineer - SOC Product Lead

About the role

The SOC Product Lead is the strategic owner of the Cybersecurity Operations Centre's detection and monitoring capabilities, treating the SOC as a continuously evolving product. The role bridges business risk, stakeholder needs, compliance obligations and the threat landscape, turning them into a prioritised roadmap that the Tech Lead and analyst teams execute. It does not involve building detection rules, but ensuring the right capabilities are built, in the right order.

Key responsibilities

• Own the SOC capability roadmap and backlog, covering detection use cases, automation workflows, tooling enhancements and analyst enablement, and write user stories and acceptance criteria
• Facilitate sprint planning, backlog refinement and sprint reviews with the Tech Lead and Design Lead, and track delivery velocity and sprint outcomes
• Act as the main interface with internal stakeholders, gather requirements and manage expectations on timelines, scope and prioritisation
• Maintain a threat-informed prioritisation approach, including a detection coverage gap register mapped to MITRE ATT&CK
• Own the SOC technology portfolio strategy (SIEM, SOAR, EDR, threat intelligence), lead vendor evaluations, RFPs and PoCs, and manage vendor relationships, contracts and SLAs
• Own the SOC technology budget, forecast spend and justify investment cases
• Define and own SOC KPIs such as MTTD, MTTR, alert fidelity, use case coverage and automation rates, and run executive dashboards and operational reviews
• Align monitoring coverage with regulatory frameworks (e.g. MAS TRM, ISO 27001, NIST CSF) and support audits

Required profile

• At least 5 years in cybersecurity, including at least 2 years in a product management, SOC management or senior security operations role with strategic responsibilities
• Demonstrated experience owning a security capability roadmap or technology portfolio, including vendor management and budget accountability
• Experience in a regulated financial services, critical infrastructure or government SOC environment
• Ability to turn business and risk requirements into security monitoring outcomes, with strong communication skills

Required skills

• Deep understanding of security monitoring and detection operations, alert triage and incident response lifecycles
• Working knowledge of MITRE ATT&CK and threat actor TTPs
• Functional understanding of SIEM (preferably Microsoft Sentinel), SOAR, EDR and threat intelligence platforms
• Exposure to cloud security monitoring on Azure and AWS