Security Operations Centre / SOC Team Lead

Security Operations Centre / SOC Team Lead
58,252 - 68,586 per annum
28.97% Employer pension contribution and more great benefits
Relaxed hybrid and flexible working environment
Location: Glasgow or Edinburgh

About the Role

Hays' Cyber practice have partnered exclusively with Registers of Scotland (RoS) on the search for a Technical Team Lead within their internal Security Operations Centre. This role will have you leading a team of analysts and working alongside security engineers to develop and automate threat detection and response playbooks, as well as security architects and the wider IT function.

The ideal candidate will have the technical expertise to work on day-to-day operations within a busy SOC, but also will have led SOC teams from a line-management, pastoral leadership, and ITSM perspective, ranging from SIEM use case tuning, to employee appraisals, KPI's and reporting metrics.

About the Organisation

Registers of Scotland (RoS) manages 21 land, property and other legal registers which are a critical asset for the Scottish economy. They aim to provide the best public service for Scotland and are on a mission to make some of the oldest public land registers in the world into some of the most modern.

Registers of Scotland (RoS) is also an award-winning organisation recognised for its technology and innovation and is a world-leading pioneer in land and property registration. Their full-stack teams design, architect, and build all our registration products in-house, and they work to create digital solutions for the people of Scotland. You will get an opportunity to nurture your creativity and develop with RoS through access to the latest data, software engineering and product delivery techniques.

Key Responsibilities

• Provide day-to-day line management, coaching, and development of SOC analysts and engineers.
• Lead the configuration, tuning, and maintenance of core SOC capabilities including log aggregation, alerting, correlation, threat detection, and response tooling.
• Define, track, and report SOC performance metrics and KPIs, ensuring operational efficiency and alignment with organisation objectives.
• Manage and mentor SOC team members, setting clear performance objectives, monitoring KPIs, analysing metrics, and driving continuous improvement through coaching, training, and performance reviews.
• Collaborate with cyber engineers to develop and automate detection logic and incident response playbooks.
• Work with Technical Product Manager and Security Architect to ensure SOC capabilities align with enterprise security architecture and strategy.
• Ensure SOC processes are integrated with ITSM systems for effective incident, change, and problem management.
• Develop and maintain scenario-based runbooks and technical procedures for incident response.
• Engage with project teams to provide security assurance for new and existing services.
• Drive continuous improvement in SOC operations, tooling, and team capability.

What We're Looking For

• Proven experience in a Security Operations Centre or operational security environment.
• Demonstrable experience managing or leading a technical team or function in an enterprise setting.
• Strong background in operating and maintaining SOC capabilities such as log management, alerting, threat detection, and incident response tooling.
• Experience in incident response, including leading technical investigations and developing response frameworks.
• Proficiency in integrating and operationalising cyber threat intelligence.
• Experience working with ITSM systems to manage and prioritise workloads.
• Experience reporting on SOC metrics including SLA/OLA performance, MTTD/MTTR, alert accuracy, and outcome-based security improvements.
• Excellent interpersonal and communication skills, with the ability to work effectively across technical and non-technical teams.
• Experience developing or implementing vulnerability management tools and processes.
• Familiarity with cloud security monitoring and hybrid infrastructure environments.
• Knowledge of relevant security frameworks such as NIST CRF, ISO 27001, NCSC CAF, and MITRE ATT&CK.
• Experience contributing to or leading SOC maturity assessments or improvement programmes.

Package, Benefits and What's in it for you

• Up to 68,586 inclusive of market supplement
• Pay progression
• 28.97% pension (employer contribution)
• 38 days annual holiday, increasing to 42 days with length of service.
• Other benefits such as career development opportunities, qualifications, up to a year in parental leave and more

Further information

For further information relating to RoS, including:
Additional details on pay & benefits

• The Civil Service Code
• Complaints process
• Use of AI in the application/recruitment process,

Please view our additional information page online: ros . gov . uk/about/publications/governance-and-corporate/2024/recruitment-information

Nationality and immigration status

In general, only nationals from the following countries (and associations of countries) are eligible for employment in the Civil Service: the United Kingdom, the Republic of Ireland, and the Commonwealth. EU nationals (with settled or pre-settled status), certain EEA nationals, Swiss and Turkish nationals are also eligible for employment. Detailed provisions on determining eligibility on the grounds of nationality and, where relevant, immigration status can be reviewed here.

gov . uk/government/publications/nationality-rules

What you need to do now

If you're interested in this role, click 'apply now' to send us your CV, or contact us for a confidential discussion.

Hays Specialist Recruitment Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept the T&C's, Privacy Policy and Disclaimers which can be found at (url removed)