SOC Lead
Shift rotations, metrics, vendor management, mentoring tier-1.
If you don't enjoy management, this is a comfortable trap.
Read the full role verdict and reasoning
Operational leadership balancing investigation quality, team capacity and escalation.
- Domain
- Cybersecurity
- Entry
- £32–40k
- Senior
- £52–65k
- You can explain investigation decisions and want to coach other analysts
- You're prepared to spend more time on people than on alerts
- You can hold a vendor and an analyst accountable in the same week
- You want to influence detection strategy without giving up technical credibility
- You took the promotion only because it was the next thing offered
- You can't bear performance conversations or rota arguments
- You'd rather keep hunting and detecting than running the floor
What "doing well" looks like in the seat
- Your team's mean time to triage and resolve improves quarter on quarter
- Analysts stay longer under you than under your predecessor
- You can hold a board-level conversation about coverage and risk
- You've killed a tool or process that wasn't earning its keep
A lead needs time and authority to coach as well as handle the queue. Ask about staffing, quality review, coverage and the division between technical leadership and line management.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
High. SOC Manager / Director of Security Ops is a real lane.
Who actually gets in
- +Senior SOC analyst
- +IR lead
- +MSSP analyst
Common misconceptions
- −That it's still hands-on detection, it's mostly people and process.
Where this leads
- Security Manager
- GRC
- vCISO
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
- GRC (Audit, Risk, Compliance)
Governance and risk work that connects control evidence to accountable decisions.
- Defensive / SOC → Detection Engineer
Security monitoring work that rewards careful investigation and defensible escalation.
- DFIR & Threat Intelligence
Digital forensics and incident response combine evidence handling with decisions during an investigation.
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.
Where this fits