{"id":193477,"url":"https://alion.io/job/triskele-labs-security-operations-centre-manager","title":"Security Operations Centre Manager","company":{"id":60634,"name":"Triskele Labs","domain":"triskelelabs.com","url":"https://alion.io/company/triskele-labs","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Melbourne, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Power BI","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Crowdstrike","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"Shuffle","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-08-31T00:00:00Z","employer_posted_date":"2026-08-31","last_verified_at":"2026-10-30T07:37:50Z","board_verified":true,"closed_at":null,"days_open":60,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":60},"description":"Triskele Labs is one of Australia’s leading sovereign cyber security firms, delivering Managed Detection & Response (MDR), Digital Forensics & Incident Response (DFIR), Offensive Security, and Governance, Risk & Compliance (GRC) services to regulated enterprises, government, and the higher education sector. Built over more than a decade, founder-led and independently owned, we partner with clients operating under some of Australia’s most demanding regulatory regimes.\nOur Security Operations Centre runs 24x7x365 and remains completely onshore, and we are the largest CREST Registered Penetration Testing company in Melbourne. Sovereign Australian ownership, deep technical capability, and front-line threat intelligence from one of the most active DFIR practices in the country sit at the centre of how we differentiate.\nWe are hiring a SOC Manager to lead the operational performance of our Australian Security Operations Centres. You will manage our L1 to L3 analyst structure, you will own rostering and capacity across a 24x7x365 operation, own the SOC’s workflow and triage automation roadmap through your SOC Automation Analyst, and be accountable for how well our MDR service actually runs in front of the client.\nThe role sits alongside our Platform Engineering Manager, and the two roles carry the MDR service between them. Platform Engineering owns what the service can detect, hunt and validate: detection engineering, cyber threat intelligence, threat hunting and breach attack simulation. The SOC owns how well that capability is operated: triage quality, service levels, escalation handling, client communication, the development of the analysts doing the work, and the workflow and triage automation that makes the operation scale.\nThat boundary is deliberate and it is the most important thing to understand about this role. You are not building the detection capability. You are leading the function that consumes it well, and will need to be the peer who tells Platform Engineering the truth about what is and is not working in the queue. The partnership is at a minimum a weekly operating rhythm and joint prioritisation, not an escalation path used after something has gone wrong.\nAutomation runs the other way. Workflow and triage automation belongs to the SOC, and the SOC Automation Analyst reports to you. You decide what gets automated next, you hold the quality bar on playbook design, and you partner with the SOAR Engineer and the DevOps team, who provide the platform capability, integrations and infrastructure underneath.\nThis is a hands-on operational leadership role, not a reporting layer. You will need enough technical depth to challenge an analyst’s conclusion, review playbook logic rather than just its outcomes, and judge the operational impact of a detection or automation change before it reaches the live queue.\nYou must be able to weigh the risk and the benefit of those decisions, to keep our service at the forefront of our clients’ cyber security concerns while supporting our team to do their work effectively and safely.\nKey Responsibilities\nLeadership\nLead, coach and manage the SOC analyst team from L1 through to L3, and the SOC Automation Analyst, across state-based Security Operations Centres, owning performance reviews, career development and succession planning.\nOwn rostering, scheduling and capacity across a 24x7x365 operation, including roster fairness, fatigue monitoring, mental health awareness and analyst wellbeing.\nRefine and drive the analyst development pathway from L1 through to L3 and onward into Platform Engineering, DFIR or engineering specialisations, identifying training needs and knowledge gaps and acting on them. \nOperational management\nEnsure day-to-day SOC operations meet SLA, KPI and incident response commitments, and act as the key operational escalation point for the team.\nOversee escalations across the L1 to L3 tiers and coordinate high-severity incident response, shift standups and handoffs.\nOwn workflow and triage automation and the SOC automation roadmap, agreed with the Head of Managed Services and delivered through the SOC Automation Analyst who reports to you: deciding what gets automated next, reviewing playbook design and logic, and holding delivery and quality.\nMaintain SOC processes, SOPs, runbooks and knowledge management aligned to ISO 20000, ISO 27001 and SOC 2, and support audit preparation and evidence rigour.\nDrive incident simulation planning, and support post-incident reviews so that what is learned reaches the runbooks.\nClient service\nAct as a senior escalation contact for key MDR clients, and attend client meetings during onboarding, escalation and service review.\nOwn the operational readiness of new client onboarding into the SOC: tooling, alerting, runbooks and analyst enablement in place before the client goes live.\nEnsure the quality, consistency and timeliness of incident documentation, case categorisation, remediation guidance, threat briefs and monthly service reporting.\nCapability and tooling\nDrive the evolution of the SOC’s tooling and automation, SIEM, SOAR and EDR, from the operational side, and evaluate emerging technology for what it would genuinely do for triage quality, response time and analyst effort.\nDefine the SOC’s operational requirements for tooling and workflow, and work with Engineering, DevOps and Platform Engineering to see them delivered.\nPlatform Engineering partnership\nHold the peer relationship with the Platform Engineering Manager: weekly operational alignment, joint prioritisation of detection improvements, and integration of client feedback into their roadmap.\nOwn the SOC side of the feedback loop, ensuring false-positive patterns, noisy alerts and missed-detection observations reach Detection Engineering in a structured, actionable form.\nEnsure Platform Engineering output, validated detections, enriched indicators, hunt findings and BAS gap data, is operationalised in the SOC with analysts trained and runbooks updated before the change reaches the queue.\nGovernance and reporting\nEnsure SOC practice remains compliant with ISO 27001, ISO 20000 and SOC 2, and contribute to internal and external governance and assurance reporting.\nProvide regular reporting to the Head of Managed Services on performance, escalations, threats, staffing and initiatives.\nOrganisational contribution\nContribute to Triskele Labs’ thought leadership through blog content, Brown Bag talks and internal showcases.\nRepresent the SOC at industry events and client forums where useful.\nLead by example to uphold the culture, values and technical standards expected of a high-performing SOC.\nApplication Process\nA cover letter addressed to Brad Morgan, Head of Managed Services, is mandatory for this role. Applications without one will not be considered. Tell us about a SOC you have run and one operational problem you fixed that the metrics can prove.\nRequirements\nAustralian citizenship or permanent residency. This is a sovereign MDR requirement and sponsorship is not available.\nBased in Melbourne and able to work on-site, with some work from home available by agreement.\nMinimum five years in a SOC environment, including at least two years in a leadership role.\nProven experience managing 24x7 SOC operations, shift teams and security case processes in an MSSP or enterprise environment, including ownership of rostering and capacity planning.\nStrong technical understanding of SIEM, SOAR, EDR and incident response, enough to challenge an analyst’s conclusion, review playbook logic, and hold a quality bar, not only to report on one.\nSound judgement on risk and benefit: able to weigh the operational upside of a detection, automation or process change against its impact on service quality, client risk, and the analysts who have to work with it.\nExcellent written and verbal communication across technical and executive audiences, including direct client escalation handling.\nAvailable for after-hours escalation as required, and able to travel occasionally to other state-based SOC locations or clients.\nHighly Regarded\nDemonstrated ownership of a workflow and triage automation capability: deciding what to automate, reviewing playbook design, and directing the person building it.\nDemonstrated ability to operate as a peer to an engineering or platform function without absorbing or duplicating its remit.\nStrong working knowledge of security frameworks including MITRE ATT&CK, NIST and ISO.\nExperience with our stack or equivalent: Microsoft Sentinel, Splunk, Rapid7 InsightIDR, Elastic, Microsoft Defender, CrowdStrike, and Shuffle or an equivalent SOAR platform.\nHands-on SOAR playbook build experience, or the ability to review playbook logic in detail rather than only its outcomes.\nExperience managing geographically distributed or state-based operational teams.\nExposure to ISO certification audits or SOC-CMM assessment.\nExperience building or operating an analyst development pathway and moving people through it.\nCertifications such as GCIA, GCIH or equivalent SOC leadership credentials, and experience with reporting tools such as Power BI.\nA bachelor’s degree in cyber security or information technology, or demonstrated equivalent experience.\nBenefits\nTeam culture is everything to Triskele Labs and it is the reason we exist. We are a forward-thinking company and always looking for ways to boost our team culture to ensure we are a destination employer. We continually undertake surveys to seek feedback from our team on ways we can improve our work environment and team member experience at Triskele Labs.\nWe provide our team a great range of additional benefits such as:\nCollaborate closely with C-Suite executives and gain insights from top industry leaders.\nHelp influence and lead the SOC Team’s growth as we continue to expand throughout the Australian market.\nEnjoy a brand-new office located in the heart of Melbourne CBD.\nFrequent events organised by our People & Culture Team.\nBenefits Specific to this role\nOperational leadership of an onshore, sovereign 24x7 SOC serving financial services, government, health and higher education.\nA genuine peer partnership with a dedicated Platform Engineering function, rather than carrying detection engineering and operations in one overloaded role.\nA dedicated SOC Automation Analyst reporting to you, and a SOAR Engineer and DevOps team to partner with. The workflow and triage automation agenda is yours to set, with people to deliver it.\nDirect reporting line to the Head of Managed Services, and close collaboration with our C-Suite. This is a role with genuine access to the people setting the direction of the business.\nReal influence over the growth of the SOC team as we continue to expand across the Australian market.\nReal capability to draw on: DFIR, CTI, threat hunting, detection engineering and offensive security practices in the same business.\nFunded certification and development, for you and for your team.\nA team that backs each other, with leaders who work the floor rather than manage from a distance.\nYou must include a cover letter addressed to Brad Morgan, Head of Managed Services to be considered for this role.\n\nWorking Arrangements:\nThe role is full time, Monday to Friday in our Melbourne office.","description_format":"text","description_chars":11273,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":2,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Incident Response","Managed Security"],"lifecycle":[{"event":"open","at":"2026-09-03T02:21:33Z"}],"visa":[],"liveness":{"score":13,"band":"cold","label":"Long shot","p_open":1,"p_active":0.454,"p_room":0.28,"age_days":60,"expected_fill_days":27,"reasons":["conf:2","velocity","win:tail","crowd:"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/triskele-labs-security-operations-centre-manager","json_url":"https://alion.io/job/triskele-labs-security-operations-centre-manager.json","meta":{"generated_at":"2026-10-30T09:40:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13936,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":60634},"rest":"https://alion.io/mcp/rest/get_company?id=60634"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftriskele-labs-security-operations-centre-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftriskele-labs-security-operations-centre-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftriskele-labs-security-operations-centre-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/triskele-labs-security-operations-centre-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftriskele-labs-security-operations-centre-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":193477}},{"tool":"search_jobs","arguments":{"company":"triskelelabs.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":193477},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}