Deputy SOC Manager

The role

Nebius is seeking an experienced Deputy SOC Manager for its Security Operations Center (SOC). This role is a technical-leaning leadership position that owns the SOC's capability: the strategy and standards the regions run to, the technology the SOC runs on, and how the SOC gets better over time. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office.

You are welcome to work in our offices in Tel Aviv, Israel.

Your responsibilities will include: 

• Help define the SOC's strategy and roadmap with the SOC Manager, and turn it into priorities the regions can execute.
• Use operational metrics across regions to find where the SOC is weak and drive the improvements that fix it.
• Work with the Regional SOC Managers on resource allocation and consistency across regions, so each region runs to the same standard.
• Own SOC processes and runbook governance, keeping procedures current, consistent, and followed.
• Apply AI and automation to cyber defense, making the SOC faster and its analysts more effective, with judgment about where it belongs.
• Mentor the Regional SOC Managers and senior analysts as a peer and sounding board, developing the SOC's next layer of leadership. 
• Own how the SOC handles high-severity incidents: the escalation criteria, the coordination process, and the post-incident review, without running individual incidents.
• Support hiring and onboarding, participating in interviews and shaping the analyst ramp-up.
• Share the SOC Manager's accountability for the SOC's performance, stepping in across all of its responsibilities when needed.

We expect you to have: 

• 8-10 years in security operations, including at least 2 years managing people.

Technical Expertise

• Solid understanding of SOC tooling and workflows (EDR, SIEM, SOAR) at the depth needed to lead analysts and challenge investigations.
• Working knowledge of investigation methodology and the incident lifecycle.
• Understanding of attacker TTPs (MITRE ATT&CK) sufficient to assess investigation quality.
• Familiarity with cloud and cloud-native environments as they relate to SOC coverage.
• Certifications such as GCIH, GSOM, or CISM are an advantage.

Leadership & Communication

• Builds trust across teams, leading the SOC from transparency and consistency rather than authority.
• Calm during high-severity incidents, with the judgment to keep the team on the right priorities.
• Genuine investment in people, developing managers and analysts while holding a fair, high bar.
• Fluent in English, written and verbal, comfortable working with international teams and stakeholders