United Kingdom · Technology and data · Principal/Manager (12-16 years)

Manager, Global Security Operations

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

As Manager, Global Security Operations, a good place to start on AI-Driven Security Orchestration & Automation (SOAR) is Planning Automation Across a Department, a free Future Fluency module at Level 5. You'd practise working out what in your department's work could be automated, what should not be, and what to recommend.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandPrincipal/Manager (12-16 years)
  • Direct reports8-12 reports
  • Reports toDirector, Global Threat Response
  • UK framework levelUsually a manager, or the deepest specialist in a team

Also advertised as Head of Security Operations · SOC Manager · Cyber Defence Manager · Security Operations Lead

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

1From this job to a course

The qualifications matched to this job

Qualifi Level 5 Extended Diploma in Cyber Security Qualifi Ltd · Level 5 · covers 5 of 8 standards
Qualifi Level 4 Diploma in Cyber Security Qualifi Ltd · Level 4 · covers 4 of 8 standards
SFJ Awards Level 4 Certificate for Protective Security Advisers SFJ Awards · Level 4 · covers 3 of 8 standards
Transcend Level 5 Diploma in Risk Management of Security Operations Transcend Awards · Level 5 · covers 2 of 8 standards
Qualifi Level 5 Extended Diploma in Networking and Cyber Security Qualifi Ltd · Level 5 · covers 2 of 8 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Incident Response, Investigations and Forensics Qualifi Level 5 Extended Diploma in Cyber Security
Incident Response and Management SFJ Awards Level 4 Certificate for Protective Security Advisers
Incident response and disaster recovery NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Security operations scope, contexts and cultures Transcend Level 5 Diploma in Risk Management of Security Operations

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Automation Fluency building AI into how work runs
Sustainability Fluency building care for people and planet into the work
Trust Fluency keeping the digital world safe
Your Plan Illustration

Built for Manager, Global Security Operations

4 units that map to this job, from the qualifications that cover it.

  1. Incident Response, Investigations and Forensics Qualifi Ltd · covers 5 of 8 standards Level 5
  2. Incident Response and Management SFJ Awards · covers 3 of 8 standards Level 4
  3. Incident response and disaster recovery NCFE · covers 2 of 8 standards Level 3
  4. Security operations scope, contexts and cultures Transcend Awards · covers 2 of 8 standards Level 5
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Manager, Global Security Operations?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI-Driven Security Orchestration & Automation (SOAR)
  • Cyber Resilience & Business Continuity Planning
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Manager, Global Security Operations plan as you set up, starting with the free Automation Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

This job means leading a global security operations centre, coordinating a team across time zones to catch and stop cyber threats before they cause damage.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Splunk/Elastic Stack (SIEM) Expert

Architecting data ingestion strategies, managing platform licensing and performance, evaluating and selecting next-gen SIEM/SOAR platforms, and reviewing complex queries and dashboards built by your team.

ServiceNow/Jira Service Management (ITSM/GRC) Expert

Overseeing the entire ITSM/GRC module for security incidents, defining SLOs/SLAs for your team, using platform data for strategic resource planning and reporting to leadership, and driving automation within the platform.

CrowdStrike Falcon/SentinelOne (EDR/XDR) Expert

Setting enterprise-wide EDR policies, managing platform deployment and agent health across global endpoints, leading vendor relationships, and evaluating emerging EDR/XDR capabilities to enhance our defence.

Recorded Future/Anomali (TIP) Advanced

Defining the organisation's threat intelligence requirements, managing API integrations with SIEM, and briefing leadership on the strategic threat landscape and specific threats relevant to our sector.

Confluence/MS Teams (Knowledge Base & Collaboration) Advanced

Establishing the knowledge management strategy for your team, auditing documentation for quality and relevance, and defining communication protocols for major incidents, ensuring clear, concise updates.

SOAR Platforms (e.g., Palo Alto Cortex XSOAR, Splunk SOAR) Advanced

Leading the design and implementation of security orchestration, automation, and response playbooks to reduce manual effort and accelerate incident handling. You'll be driving automation initiatives.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Incident Response Strategy Follow documented playbooks; escalate deviations to L2/L3. Adapt playbooks for non-routine incidents; propose minor changes to manager. Lead complex incident response; design new playbooks; make real-time tactical decisions within incident scope.
Team Scheduling & Resourcing Adhere to assigned shift schedule. Request shift changes; propose minor adjustments to workload. Help coordinate team coverage; provide input on resource needs for specific projects.
Tool Selection & Optimisation Use assigned tools following instructions. Propose minor tool configurations or improvements. Evaluate new features of existing tools; recommend specific tool enhancements; contribute to pilot programmes for new tech.
Budget Allocation No budget authority. No budget authority. Propose small-scale training or tool purchases (up to £5K) to manager.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Mean Time to Detect (MTTD)
The average time it takes for your team to identify a genuine security incident from the initial alert.
Target · < 30 minutes for critical incidents

If a critical server is compromised at 10:00, your team should have it flagged as an incident by 10:30. We'll track the average across all critical alerts.

Mean Time to Contain (MTTC)
The average time from detection until an identified threat is isolated and prevented from spreading.
Target · < 2 hours for critical incidents

Once a critical incident is detected (e.g., ransomware), the team needs to have the affected systems isolated within two hours to stop further damage.

False Positive Rate (FPR)
The percentage of security alerts that turn out to be benign or non-malicious.
Target · < 10% on key SIEM rules

If your SIEM generates 100 alerts, we want fewer than 10 of those to be 'noise' that wasted an analyst's time. This shows effective tuning.

Team SLA Adherence
The percentage of incidents where your team meets the agreed-upon Service Level Agreements for response and resolution.
Target · > 95% for all incident severities

If a P1 incident requires a response within 15 minutes, your team needs to hit that target 95% of the time, even when things are hectic.

Knowledge Base Contribution & Quality
The number of new or updated playbooks, SOPs, and knowledge articles created or significantly improved by your team.
Target · 5+ high-quality contributions per analyst per quarter

An analyst creates a new playbook for a novel phishing technique, complete with screenshots and clear steps, which is then peer-reviewed and published.

Team Morale & Retention
How happy and engaged your team is, reflected in their willingness to stay and contribute.
  • Low attrition rates (below 15% annually), positive feedback in anonymous surveys, active participation in team initiatives, and analysts proactively suggesting improvements. You'll also see it in how they support each other during tough incidents.
Incident Post-Mortem Quality
The thoroughness and actionable insights derived from incident reviews.
  • Post-mortems consistently identify root causes, propose concrete preventative actions, include lessons learned, and are shared effectively with relevant teams (e.g., Product Security, Infrastructure). They aren't just 'tick-box' exercises
  • they drive real change.
Stakeholder Confidence
How much trust and reliance other teams (like IT, Product, Legal) place in your team's ability to handle security matters.
  • Other departments proactively consult your team on new projects, leadership relies on your input for strategic security decisions, and there's a general sense of calm and competence when your team is involved in a security issue. They know you've got it covered.
Process Improvement & Innovation
Your ability to continuously refine and improve the security operations processes and tools.
  • Regular updates to playbooks and workflows, successful implementation of new automation (e.g., SOAR rules), measurable reductions in manual effort, and proactive identification of new tools or techniques that would benefit the team. You're not just following the rules
  • you're making them better.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Protecting the Organisation

You get a real kick out of stopping bad actors and keeping the company safe. The idea of preventing a breach, or rapidly containing one, is what gets you out of bed.

Successfully leading the response to a sophisticated phishing campaign that could have led to significant data loss, and seeing the positive impact on the business.

Building and Developing a High-Performing Team

You thrive on coaching, mentoring, and seeing your team members grow into more capable security professionals. Their success is your success.

An analyst you've mentored for a year gets promoted to a Senior role, directly because of your guidance and the opportunities you created for them.

Continuous Improvement and Optimisation

You're always looking for ways to make things better – whether it's tuning alerts, automating workflows, or refining incident response procedures. Stagnation is your enemy.

Implementing a new SOAR playbook that reduces manual effort for a common incident type by 70%, freeing up your team for more complex work.

What frustrates people
  • Alert Fatigue: Your team will be sifting through thousands of alerts, and a good chunk of them will be noise. It's a constant battle to tune them out.
  • The 'User Problem': Despite all the tech, a significant number of incidents will still stem from human error – someone clicking a dodgy link, for instance. It's frustrating, but it's reality.
  • Time Zone Purgatory: Managing a global team means early morning or late-night calls are a regular occurrence. You'll often be coordinating across multiple hemispheres.
  • Budget Constraints: You'll have great ideas for new tools or training, but you'll often have to fight for the budget to make them happen. It's never endless money.
  • Documentation Debt: You'll inherit some outdated playbooks and processes, and getting the team to consistently update them can feel like pulling teeth.
  • The 'Security vs. Business' Conflict: Sometimes, you'll have to push back against business units that want to prioritise speed or convenience over security, and those conversations can be tough.
What this role does not give you
  • A purely technical, hands-on role: While you need technical credibility, your day-to-day is about leadership, strategy, and process, not deep diving into every alert.
  • Predictable hours: Incidents don't respect office hours. Expect occasional out-of-hours work, especially with a global team.
  • A static environment: The threat landscape changes constantly, so if you prefer things to stay the same, you'll find this role frustrating.
  • Unlimited resources: You'll always be doing more with less, optimising existing tools, and making smart, cost-effective decisions.

8Who you work with

This role directly impacts the organisation's ability to detect, respond to, and recover from cyber incidents globally. Your team's effectiveness directly reduces financial losses from breaches, protects customer data, and maintains regulatory compliance. Essentially, you're safeguarding the company's operational continuity and reputation. Get it right, and we sleep soundly. Get it wrong, and it's a very bad day for everyone.

Inside the business
  • Director, Global Threat Response
  • Head of Infrastructure
  • Head of Product Security
  • Legal & Compliance Teams
  • Regional IT Managers
  • Internal Audit
Outside the business
  • Security Vendors (Splunk, CrowdStrike)
  • External Auditors
  • Incident Response Consultants
  • Industry Peer Groups

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • At least 5-8 years of hands-on experience in a Security Operations Centre (SOC) or incident response role, ideally with some lead experience.
  • Proven experience managing or leading a team of security analysts, including performance management and development.
  • Demonstrable experience with major SIEM platforms (Splunk, Elastic) and EDR solutions (CrowdStrike, SentinelOne) at an advanced level.
  • Strong understanding of network protocols, operating systems (Windows, Linux), and cloud environments (AWS, Azure).
  • Experience defining and optimising incident response processes and playbooks.
  • Excellent written and verbal communication skills, especially for technical and executive audiences.

10What to practise next

Where the job is going, and what to do about it starting this week.

Cloud-Native Security Operations

Our infrastructure is increasingly moving to the cloud. You'll need to understand the unique security challenges and opportunities of cloud environments (AWS, Azure, GCP) to effectively secure them and guide your team on cloud-specific incident response.

Cloud Security Posture Management (CSPM) · Serverless security · Container security · Cloud Identity and Access Management (IAM)

  • This quarter: Complete an AWS or Azure security certification (e.g., AWS Certified Security – Specialty).
  • Next quarter: Work with the cloud engineering team to review their security architecture and identify gaps in monitoring or response.
  • Month 6: Lead a project to integrate cloud security logs (e.g., AWS CloudTrail, Azure Monitor) more effectively into your SIEM.
  • Ongoing: Follow cloud security blogs and industry experts to stay current on new threats and best practices.

Quick win: Review your current SIEM's cloud log ingestion and ensure you're collecting all relevant security events from your primary cloud provider.

Threat Modelling & Attack Surface Management

Moving beyond reactive incident response, you'll need to be more proactive in identifying potential attack paths and reducing our overall attack surface. This means understanding how attackers think and helping to build security in from the start.

STRIDE/PASTA threat modelling frameworks · External attack surface management (EASM) · Red teaming exercises · Vulnerability management integration

  • This quarter: Take a course on threat modelling (e.g., from OWASP or a commercial provider).
  • Next quarter: Collaborate with the Product Security team to conduct a threat model for a critical new application or service.
  • Month 6: Implement an EASM tool and integrate its findings into your vulnerability management process.
  • Ongoing: Participate in industry webinars on advanced threat hunting techniques and attacker methodologies.

Quick win: Map out the top 5 most critical assets in your organisation and brainstorm potential attack paths against them. This is a simple form of threat modelling.

11Staying current once you are in

What people here do to keep up
  • Regularly attend industry conferences (e.g., Black Hat, RSA, SANS Summits) to stay current on emerging threats and technologies.
  • Actively participate in cybersecurity communities and information sharing groups (e.g., ISACs, local meetups) to build your network and share insights.
  • Dedicate time each week to reading threat intelligence reports, security blogs, and whitepapers to keep your knowledge sharp.
  • Mentor junior security professionals, either formally within the organisation or through external programmes, to hone your leadership and coaching skills.
  • Pursue advanced certifications in areas like cloud security, forensics, or security architecture to broaden your expertise.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

AI-Driven Security Orchestration & Automation (SOAR)

AI and automation are rapidly transforming SOC operations. Manual triage and response are becoming unsustainable. Managers who can effectively integrate AI into their SOAR platforms will drastically improve their team's efficiency and effectiveness, reducing alert fatigue and accelerating response times.

  • AI-powered alert enrichment
  • Automated incident playbooks
  • Machine learning for anomaly detection
  • Prompt engineering for security tasks

Cyber Resilience & Business Continuity Planning

It's no longer 'if' but 'when' an organisation will face a significant cyber incident. The focus is shifting from pure prevention to ensuring the business can continue operating even during an attack. As a manager, you'll need to integrate your incident response plans with broader business continuity and disaster recovery strategies.

  • Resilience by design
  • Tabletop exercises for major incidents
  • Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
  • Supply chain cyber risk management

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Incident Response Lifecycle (PICERL)
  • Threat Triage & Prioritisation
  • Log Analysis & Correlation
  • Geopolitical Threat Awareness
  • Playbook Development & Execution
  • Security Architecture & Design Principles

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    Senior Cybersecurity Support Analyst (L3) or Lead Cybersecurity Support Analyst (L4)

    5-8 years in a senior analyst role, or 2-4 years as a lead.

    Skills to master

    • Deep technical incident response, playbook design, informal team leadership/mentoring, strong communication with technical and non-technical audiences, proactive threat hunting.

    You're ready to move on when

    • Consistently leading complex incident investigations from start to finish.
    • Successfully mentoring 2-3 junior analysts and seeing them grow.
    • Proactively identifying and implementing process improvements for the SOC.
    • Being the go-to person for complex technical questions within the team.
  2. 2

    Security Consultant (with SOC focus)

    7-10 years in consulting, with at least 3-5 years focused on security operations or incident response.

    Skills to master

    • Client management, project delivery, security programme design, understanding of various SOC models, ability to quickly assess and improve security operations in different environments.

    You're ready to move on when

    • Successfully delivered multiple SOC design or improvement projects for clients.
    • Strong ability to translate technical security needs into business requirements.
    • Experience building and presenting compelling business cases for security investments.
    • Comfortable operating in diverse technical and organisational contexts.
  3. 3

    IT Manager with strong Security Background

    8-12 years in IT management, with a clear focus and passion for cybersecurity.

    Skills to master

    • People management, budget oversight, project management, understanding of IT infrastructure, and a demonstrable commitment to security best practices and incident handling.

    You're ready to move on when

    • Managed a team of IT professionals, including performance and development.
    • Successfully overseen IT projects with significant security components.
    • Demonstrated proactive efforts to improve security posture within their IT domain.
    • Clear understanding of security principles and incident response processes.

15Where this role leads

The long view: This role can lead to Chief Information Security Officer, VP of Engineering or CTO, or Head of Cyber Risk and Governance.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Manager, Global Security Operations is actually changing.

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Incident Response, Investigations and Forensics, worked against Manager, Global Security Operations.

Incident Response, Investigations and Forensics Level 5

Applied to your work in Manager, Global Security Operations

This unit aims to equip learners with an understanding of incident response as a business function, including the operation of Computer Emergency Response Teams (CERTs) and aligned task forces for business continuity, disaster recovery, and crisis management. Learners will also understand how major computer incidents are formally investigated, including evidence gathering and analysis, and the relevant legal and ethical considerations.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
Manager, Global Security Operations
  • Incident Response Lifecycle (PICERL)
  • Threat Triage & Prioritisation
  • Log Analysis & Correlation
  • Geopolitical Threat Awareness
  • Playbook Development & Execution
  • Security Architecture & Design Principles
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Manager, Global Security Operations is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Director, Global Threat Response (L6)

    3-5 years in the Manager, Global Security Operations role.

    From L5 to L6

    • Advanced Risk Management Frameworks Implementing and overseeing enterprise-wide cyber risk management.
    • Security Architecture Oversight Providing strategic guidance on security architecture across the organisation.
    • Regulatory Liaison Direct engagement with regulators on compliance and incident reporting.
    • Vendor Strategy & Governance Managing relationships with strategic security partners and driving vendor selection at an enterprise level.
  2. Head of Product Security (L5/L6 equivalent)

    3-5 years in the Manager, Global Security Operations role.

    Lateral move, potentially to L6 depending on scope.

    • Application Security Testing (SAST, DAST, SCA) Deep understanding and management of these tools and processes.
    • Cloud-Native Application Security Securing applications built and deployed in cloud environments.
    • API Security Expertise in securing APIs against common attack vectors.
    • DevSecOps Implementation Driving the integration of security into DevOps pipelines.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real, security operations can be a grind. Alert fatigue, endless logs, and the constant pressure to be faster than the bad guys. But what if you could give your team a superpower? We're talking about using AI to cut through the noise, automate the mundane, and free up your analysts for the really interesting, high-impact work.

For a Manager of Global Security Operations, AI isn't just a buzzword; it's a strategic advantage. It means your team can handle more incidents with greater accuracy, reduce burnout, and ultimately, provide a stronger defence. We're building an AI-first culture, and you'll be at the forefront of implementing these tools to make your team incredibly productive.

Alert Triage Automation

Imagine AI automatically sifting through thousands of low-fidelity alerts, enriching them with threat intelligence, and even closing known false positives. Your team only sees the alerts that truly matter, saving them hours of tedious manual review. This means they can focus on actual threats, not just noise.

Incident Correlation & Analysis

AI can connect the dots across disparate logs from your SIEM, EDR, and cloud platforms. It'll spot subtle patterns and link seemingly unrelated events into a coherent attack narrative, helping your analysts understand the full scope of an incident much faster than any human could manually. This is about finding the needle in the haystack, instantly.

Threat Intelligence Summarisation

Bombarded with 50-page threat reports? Point an AI at it, and it'll summarise the key Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IOCs), and relevant mitigations in minutes. This keeps your team informed and proactive without drowning in data, allowing you to brief leadership on emerging threats quickly.

Communication & Report Drafting

AI can draft the first version of incident reports, post-mortem summaries, and even user communications about phishing campaigns based on ticket data. Your analysts then review and refine, drastically cutting down the time spent on administrative tasks and ensuring consistent, clear messaging. It's like having a dedicated technical writer on demand.

Common questions

Common questions

How do you become a Manager, Global Security Operations?

Common routes in include Senior Cybersecurity Support Analyst or Lead Cybersecurity Support Analyst (5-8 years in a senior analyst role, or 2-4 years as a lead.), Security Consultant (with SOC focus) (7-10 years in consulting, with at least 3-5 years focused on security operations or incident response.) and IT Manager with strong Security Background (8-12 years in IT management, with a clear focus and passion for cybersecurity.). Times vary with prior experience.

Where can a Manager, Global Security Operations progress to?

This role can lead on to Director, Global Threat Response (3-5 years in the Manager, Global Security Operations role.) and Head of Product Security (3-5 years in the Manager, Global Security Operations role.), depending on the skills you build.

What new skills matter most for a Manager, Global Security Operations?

Increasingly, AI-Driven Security Orchestration & Automation (SOAR) and Cyber Resilience & Business Continuity Planning. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

17Where to go from here

Other roles at Level 5

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

More jobs in technology and data

Stay in the field you know and move sideways rather than up.

If you leave this industry

The skills built here transfer across most industries. Finance, tech, healthcare, manufacturing and government all need security operations leadership. Global coordination and people management experience count for a lot in any sector.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free Automation Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.