Security Operations Centre / SOC Team Lead
JOB_53659334759812Job type
PermanentLocation
Edinburgh or GlasgowWorking Pattern
Full-timeSpecialism
Cyber SecurityIndustry
Government & Public ServicesPay
Up to £68,586 + 28.97% pension and more
Security Operations Centre, SOC, SIEM, Security Leadership, SOC Lead, EDR
Security Operations Centre / SOC Team Lead
£58,252 - £68,586 per annum
28.97% Employer pension contribution and more great benefits
Relaxed hybrid and flexible working environment
Location: Glasgow or Edinburgh
About the Role
About the Role
Hays’ Cyber practice have partnered exclusively with Registers of Scotland (RoS) on the search for a Technical Team Lead within their internal Security Operations Centre. This role will have you leading a team of analysts and working alongside security engineers to develop and automate threat detection and response playbooks, as well as security architects and the wider IT function.
The ideal candidate will have the technical expertise to work on day-to-day operations within a busy SOC, but also will have led SOC teams from a line-management, pastoral leadership, and ITSM perspective, ranging from SIEM use case tuning, to employee appraisals, KPI’s and reporting metrics.
About the Organisation
Registers of Scotland (RoS) manages 21 land, property and other legal registers which are a critical asset for the Scottish economy. They aim to provide the best public service for Scotland and are on a mission to make some of the oldest public land registers in the world into some of the most modern. You can get an idea of their mission and culture by viewing this short video: (https://www.youtube.com/watch?v=ku6olOJkSpU)
Registers of Scotland (RoS) is also an award-winning organisation recognised for its technology and innovation and is a world-leading pioneer in land and property registration. Their full-stack teams design, architect, and build all our registration products in-house, and they work to create digital solutions for the people of Scotland. You will get an opportunity to nurture your creativity and develop with RoS through access to the latest data, software engineering and product delivery techniques.
Key Responsibilities
- Provide day-to-day line management, coaching, and development of SOC analysts and engineers.
- Lead the configuration, tuning, and maintenance of core SOC capabilities including log aggregation, alerting, correlation, threat detection, and response tooling.
- Define, track, and report SOC performance metrics and KPIs, ensuring operational efficiency and alignment with organisational objectives.
- Manage and mentor SOC team members, setting clear performance objectives, monitoring KPIs, analysing metrics, and driving continuous improvement through coaching, training, and performance reviews.
- Collaborate with cyber engineers to develop and automate detection logic and incident response playbooks.
- Work with Technical Product Manager and Security Architect to ensure SOC capabilities align with enterprise security architecture and strategy.
- Ensure SOC processes are integrated with ITSM systems for effective incident, change, and problem management.
- Develop and maintain scenario-based runbooks and technical procedures for incident response.
- Monitor and report on SOC performance, including:
- Volume and severity of security incidents
- Average time to detect (MTTD) and respond (MTTR) to threats
- Accuracy and relevance of alerts (e.g. reducing false alarms)
- Coverage of threat detection across systems and services
- Outcome-focused metrics such as reduced dwell time, successful containment rates, and measurable improvements in security posture.
- Engage with project teams to provide security assurance for new and existing services.
- Drive continuous improvement in SOC operations, tooling, and team capability.
What We’re Looking For
- Proven experience in a Security Operations Centre or operational security environment.
- Demonstrable experience managing or leading a technical team or function in an enterprise setting.
- Strong background in operating and maintaining SOC capabilities such as log management, alerting, threat detection, and incident response tooling.
- Experience in incident response, including leading technical investigations and developing response frameworks.
- Proficiency in integrating and operationalising cyber threat intelligence.
- Experience working with ITSM systems to manage and prioritise workloads.
- Experience reporting on SOC metrics including SLA/OLA performance, MTTD/MTTR, alert accuracy, and outcome-based security improvements.
- Excellent interpersonal and communication skills, with the ability to work effectively across technical and non-technical teams.
- Experience developing or implementing vulnerability management tools and processes.
- Familiarity with cloud security monitoring and hybrid infrastructure environments.
- Knowledge of relevant security frameworks such as NIST CRF, ISO 27001, NCSC CAF, and MITRE ATT&CK.
- Experience contributing to or leading SOC maturity assessments or improvement programmes.
Package, Benefits and What’s in it for you
- Up to £68,586 inclusive of market supplement
- Pay progression
- 28.97% pension (employer contribution)
- 38 days annual holiday, increasing to 42 days with length of service.
- Other benefits such as career development opportunities, qualifications, up to a year in parental leave and more
Further information
For further information relating to RoS, including:
For further information relating to RoS, including:
- Additional details on pay & benefits
- The Civil Service Code
- Complaints process
- Use of AI in the application/recruitment process,
Please view our additional information page online. https://www.ros.gov.uk/about/publications/governance-and-corporate/2024/recruitment-information
Nationality and immigration status
In general, only nationals from the following countries (and associations of countries) are eligible for employment in the Civil Service: the United Kingdom, the Republic of Ireland, and the Commonwealth. EU nationals (with settled or pre-settled status), certain EEA nationals, Swiss and Turkish nationals are also eligible for employment. Detailed provisions on determining eligibility on the grounds of nationality and, where relevant, immigration status can be reviewed here.
https://www.gov.uk/government/publications/nationality-rules
https://www.gov.uk/government/publications/nationality-rules
What you need to do now
If you’re interested in this role, click ‘apply now’ to send us your CV, or contact us for a confidential discussion.
If you’re interested in this role, click ‘apply now’ to send us your CV, or contact us for a confidential discussion.
Security Operations Centre / SOC Team LeadJOB_536593347598122026-01-092026-04-09
Talk to James Dilks, the specialist consultant managing this position
Located in Leeds, Part 6th Floor, Broad Gate, The HeadrowTelephone 0113 200 3750Click here to access our Privacy Policy, which provides detailed information on how we use and protect your personal information, and your rights in relation to this.
JOB_53659334759812