Director - Intelligence-Led Security Operations Centre (SOC) (IT)

At CGI, we help organisations make confident, informed decisions about cyber resilience. As our SOC Solutions & Cyber Advisory Lead, you will sit at the heart of our intelligence-led SOC services, shaping solutions that balance technical excellence with real-world business outcomes. Working directly with clients and internal experts, you?ll influence how services are designed, sold, and delivered, ensuring they are robust, scalable, and aligned to client risk and maturity. You?ll be trusted to lead with insight, encouraged to think creatively about service evolution, and supported by a collaborative culture that enables you to make a meaningful, lasting impact. CGI was recognised in the Sunday Times Best Places to Work List 2025 and has been named a UK ?Best Employer? by the Financial Times. We offer a competitive salary, excellent pension, private healthcare, plus a share scheme (3.5% + 3.5% matching) which makes you a CGI Partner not just an employee. We are committed to inclusivity, building a genuinely diverse community of tech talent and inspiring everyone to pursue careers in our sector, including our Armed Forces, and are proud to hold a Gold Award in recognition of our support of the Armed Forces Corporate Covenant. Join us and you?ll be part of an open, friendly community of experts. We?ll train and support you in taking your career wherever you want it to go. If you thrive in high-tempo environments, understand the commercial and operational realities of multi-customer SOC delivery, and want to shape the next evolution of intelligence-led security operations, this role offers the autonomy, scale, and strategic influence to do exactly that. Due to the secure nature of the programme, you will need to hold UK Security Clearance or be eligible to go through this clearance. This is a hybrid position. Candidate profile: As Director of Intelligence-Led SOC, you will: Define and execute the strategic vision for an intelligence-led SOC capability across multiple customer environments Lead and develop SOC, and technical leads, creating a high-performance, accountable culture Drive operational maturity, embedding intelligence-driven detection, response, and proactive threat management Own end-to-end SOC service delivery across multiple platforms and customer estates Ensure optimisation and effective utilisation of SIEM and SOAR platforms (e.g., ArcSight, FortiNet, Splunk, Microsoft Sentinel) Oversee the full incident lifecycle: detection, triage, response, escalation, crisis management, and post-incident review Embed consistent, scalable operational standards aligned to ITIL, NIST, MITRE ATT&CK, ISO 27001, and CREST frameworks Act as executive point of contact for clients and senior stakeholders, articulating cyber risk, performance metrics, and strategic outcomes Maintain operational readiness for audits, certifications, and industry accreditations Hold budgetary, and resource planning accountability for the SOC function Drive innovation, automation, and continuous improvement to enhance detection efficacy and reduce dwell time Required qualifications to be successful in this role

• Proven experience leading large-scale SOC operations within MSSP, MSP, or multi-tenant environments
• Demonstrable experience transforming SOC capabilities into intelligence-led, maturity-driven functions
• Strong executive-level people leadership: developing seniors, succession planning, and organisational design
• Deep expertise in incident management, crisis leadership, and service delivery in high-pressure environments
• Strong technical fluency in SIEM/SOAR ecosystems
• Working knowledge of NIST, MITRE ATT&CK, ISO 27001, CREST, and ITIL-aligned service management
• Commercial acumen including budgeting, forecasting, and resource optimisation
• The ability to translate technical security risk into clear, outcome-focused business language
• Experience engaging C-level stakeholders across client organisations

#LI-JS2