Hiring a SOC manager: profile, missions and interviews

A SOC can have excellent analysts and still struggle: exhausting rotations, detection rules nobody reviews, alerts piling up with no one sure which ones matter. Very often, what is missing is not another analyst but someone to run the operation. This guide helps you define the SOC manager role, recognise the right profile and assess candidates on what will actually make the difference.

What a SOC manager does

A SOC manager is not the L3 analyst promoted for seniority. Their value shows in the quality of detection and the health of the team, not in the number of incidents they handle themselves.

Their most common missions:

• Organise the work: rotation and on-call schedules, the split between L1, L2 and L3, clear escalation procedures.
• Steer detection: decide which threats to cover first, get noisy rules reviewed, track which log sources are actually collected.
• Measure and report: build useful metrics (time to triage, false positive rate, coverage of critical assets) and present them to the CISO or leadership without dressing them up.
• Connect with incident response: know when an alert becomes an incident, who takes over and how information flows.
• Manage vendors and tools: oversee an MSSP where there is one, prepare SIEM or EDR decisions, follow contracts and service commitments.
• Grow the team: hiring, onboarding, skills development, and preventing the wear that comes with shift work.

If your SOC is fully outsourced, the role changes: it becomes mostly about managing a provider and challenging its reports. The profile is close, but say so clearly in the job ad.

Why hire for this role now

Several signs show that a SOC needs a dedicated manager rather than one more analyst:

1. The CISO spends a meaningful share of their time on scheduling questions or alert triage.
2. Your most experienced analysts leave, often for lack of a career path.
3. No one can say what share of the estate is really monitored.
4. Detection rules pile up without review or documentation.
5. Reporting obligations are getting closer: the NIS2 directive (Directive (EU) 2022/2555) requires in-scope entities to send an early warning within 24 hours of becoming aware of a significant incident. That assumes a detection and escalation chain that works.

Our article on which profiles to hire for NIS2 shows how this role fits with the rest of the team.

The profile to look for

Real investigation experience

A SOC manager who has never triaged alerts cannot judge the quality of a ticket or spot a badly designed rule. Look for genuine analysis experience, ideally up to L2 or L3: reading Windows and Active Directory logs, working with an EDR, reasoning like an investigator. They do not need to be the best technician on the team, but they must know which questions to ask the person who is.

A sense of organisation and measurement

This is what separates the role from a senior analyst position. The candidate should be able to build a sustainable schedule, prioritise detection work and use metrics to make decisions rather than to decorate a dashboard.

Managing a team on rotation

Leading people who work nights, weekends or on call takes particular care: fair schedules, fatigue management, career prospects. Our article on retaining cyber teams covers the levers that matter, and this manager will be the first to own them.

Communication at two levels

A SOC manager talks to analysts in the morning and to leadership in the afternoon. They should be able to explain why an alert was closed with no action, just as well as why extra logging budget is needed.

Where good candidates come from

For candidates coming from detection engineering, our guide to hiring a detection engineer helps you assess the technical side.

Skills to assess

Here is a scorecard to share with everyone on the panel:

1. Triage and investigation: can they quickly judge the quality of an analysis and spot a rushed conclusion?
2. Detection strategy: how do they choose which threats to cover first, and from which log sources?
3. Noise reduction: what is their approach to a rule that produces mostly false positives?
4. Metrics: which metrics do they track, and which do they refuse to track because they drive the wrong behaviour?
5. Organisation: how do they build a sustainable rotation and on-call schedule?
6. Escalation: where do they draw the line between the SOC and the incident response team?
7. Vendor management: how do they challenge an MSSP on alert quality?
8. Management: how do they help an L1 grow into an L2, and how do they handle an analyst who is struggling?

Certifications show learning, not the ability to lead. Our article on cybersecurity certifications in hiring puts them in their proper place.

A scenario that reveals the level

A standard interview is a poor way to measure whether someone can run a SOC. A one-hour scenario led by a security practitioner tells you far more. Here is a simple format.

The scenario

Give the candidate a fictional brief describing a SOC: headcount, rotation setup, tools, connected log sources, a few qualitative indicators ("lots of false positives on VPN logins", "workstations well covered, cloud servers barely logged") and two or three anonymised or fully synthetic tickets.

The questions

• What are your three priorities for the first 90 days, and why those?
• What do you think of these tickets, and what would you tell their authors?
• Which metrics would you present to the CISO next month?
• An analyst tells you they can no longer keep up with on-call. What do you do?

Listen above all to the reasoning. Do they ask questions before proposing anything? Do they separate tooling, process and people issues? Can they drop some ambitions to secure the essentials?

This follows the approach we use for every profile: our shortlisted candidates prove their skills on hands-on labs, and for a leadership role we add a scenario like this one. To structure the rest of the interview, our method for structuring a technical cyber interview applies here too.

Making a credible offer

A strong SOC manager looks less at the title than at the resources. Be specific about:

• Scope: in-house, hybrid or outsourced SOC, number of analysts, hours of coverage.
• Reporting line: to the CISO, the CIO or an operations director. This choice says a lot about the place given to security.
• Budget and autonomy: can they change tooling, hire, choose vendors?
• On-call: do they take part in rotations themselves, and on what terms?
• Career path: towards deputy CISO, head of security operations, or a wider scope including incident response.

Pay varies widely with team size, sector, region and on-call load. Set a realistic range during the briefing so you do not lose a good candidate at offer stage.

Mistakes to avoid

• Promoting your best analyst by default: an excellent technician can be unhappy in a management role. Ask them honestly.
• Hiring a manager with no technical culture: the team will notice quickly and stop raising the real problems.
• Confusing SOC manager and incident response lead: the two roles work closely but need different reflexes. Our guide to hiring an incident response lead covers the second.
• Hiding the real state of the SOC: a serious candidate will ask to see the metrics. If they discover reality after joining, they will leave.
• A process that drags: profiles at this level are scarce and in demand. Keep the steps few and the feedback fast.

In short

Hiring a SOC manager means looking for a rare balance: enough technical depth to earn the analysts' trust, enough method to steer detection with useful metrics, and enough care for people that a team on rotation lasts. A shared scorecard, a realistic scenario and a transparent offer on resources will help you avoid most mistakes. To strengthen the team they will lead, our guide to hiring a SOC analyst takes over from here.

Looking for a SOC manager? Tell us about your role: a recruiter and a security practitioner run the search together, and every shortlisted candidate has proven themselves on a hands-on lab. See how we work.