Head of Security Operations Center (SOC) & Incident Management (CSIRT)

Quick Facts

• Role: Head of SOC & Incident Management (CSIRT)
• Focus: 24/7 SOC operations, incident response coordination, detection engineering, and security automation

Description

You will lead the Security Operations Center (SOC) and the CSIRT team, shaping their direction by defining priorities, modern security processes, and technologies for handling severe cyber incidents. You will manage SOC analysts and coordinate monitoring, detection, assessment, escalation, and the quality of incident remediation and follow-up corrective actions. You will also develop detection scenarios, metrics, reporting, and SOC automation, working closely with security, IT, and OT operations and system owners.

Responsibilities

• Run SOC operations: set priorities, processes, responsibilities, and ensure continuous readiness for cyber events and incidents
• Lead SOC and CSIRT teams responsible for responding to cyber security incidents
• Coordinate incident monitoring, detection, evaluation, escalation, and remediation quality and corrective measures
• Develop detection scenarios, metrics, reporting, and automate SOC workflows
• Improve security technologies, especially SIEM, EDR, NDR, SOAR, and vulnerability management tools
• Coordinate critical incidents with security, IT, OT operations, system owners, leadership, and external vendors

Requirements

• University degree or secondary education in IT, cyber security, or a related technical discipline (or equivalent relevant practice)
• Minimum 3 years of cyber security experience, including at least 1 year in SOC, security monitoring, or incident management
• Ability to lead experts and/or coordinate an incident response team (advantage)
• Working knowledge of SIEM, EDR/XDR, NDR, SOAR, vulnerability management, and threat intelligence
• Ability to assess technical outputs, manage escalation, and set risk-based priorities
• Knowledge of cyber incident management principles and frameworks such as MITRE ATT&CK and NIST (or equivalent)
• Clear communication of technical risks to leadership and ability to work in English with documentation

Benefits

• Contract pay matched to experience
• 6 weeks of vacation
• Reduced working time: 37.5 hours/week
• Flexible schedule with fixed core time (8:30–13:30)
• Contributions for meals, commuting, and vacation for you and your children
• Pension savings or long-term investment product (DIP) up to 1,850 CZK/month after 6 months
• Discounted ČD travel (IN Card approx. 1/10 price; after 6 months also for family) and international travel benefits after 1 year
• Discounted fuel via CSS/OMV card and additional partner benefits
• Multisport card
• Indefinite-term employment with a 1-year probation period
• Stability and support for professional training and career growth