UK

United Kingdom · Technology and data · Principal/Manager (12-16 years)

Security Operations Manager

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

Start my free Automation Fluency module

As a Security Operations Manager, a good place to start on AI-Driven Security Orchestration & Response is Planning Automation Across a Department, a free Future Fluency module at Level 5. You'd practise working out what in your department's work could be automated, what should not be, and what to recommend.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandPrincipal/Manager (12-16 years)
  • Direct reports3-8 reports
  • Reports toDirector of Security Operations
  • UK framework levelUsually a manager, or the deepest specialist in a team

Also advertised as SOC Manager · Cyber Defence Manager · Incident Response Lead (Managerial) · Head of Security Operations

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

Qualifi Level 5 Extended Diploma in Cyber Security Qualifi Ltd · Level 5 · covers 5 of 13 standards
SEG Awards Level 5 Diploma in Software Engineering with Cyber Security Skills and Education Group Awards · Level 5 · covers 2 of 13 standards
Qualifi Level 5 Extended Diploma in Networking and Cyber Security Qualifi Ltd · Level 5 · covers 2 of 13 standards
Qualifi Level 3 Diploma in Cyber Security Management and Operations Qualifi Ltd · Level 3 · covers 5 of 13 standards
NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma) NCFE · Level 3 · covers 4 of 13 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Incident Response, Investigations and Forensics Qualifi Level 5 Extended Diploma in Cyber Security
Incident Response and Intrusion Detection SEG Awards Level 5 Diploma in Software Engineering with Cyber Security
Detecting Complex Cyber Threats to Critical National Infrastructure SFJ Awards Level 5 Award in Industrial Cyber Security – Detect, Respond, Recover
Investigations and Incident Response Qualifi Level 3 Diploma in Cyber Security Management and Operations
Incident response and disaster recovery NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Automation Fluency building AI into how work runs
Trust Fluency keeping the digital world safe
Your Plan Illustration

Built for Security Operations Manager

5 units that map to this job, from the qualifications that cover it.

  1. Incident Response, Investigations and Forensics Qualifi Ltd · covers 5 of 13 standards Level 5
  2. Incident Response and Intrusion Detection Skills and Education Group Awards · covers 2 of 13 standards Level 5
  3. Detecting Complex Cyber Threats to Critical National Infrastructure SFJ Awards · covers 1 of 13 standards Level 5
  4. Investigations and Incident Response Qualifi Ltd · covers 5 of 13 standards Level 3
  5. Incident response and disaster recovery NCFE · covers 4 of 13 standards Level 3
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Security Operations Manager?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI-Driven Security Orchestration & Response
  • Human-Centric Security Leadership
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Security Operations Manager plan as you set up, starting with the free Automation Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Ready to pay? Subscribe for £70 a month

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

A Security Operations Manager leads the team that keeps an organisation's digital assets safe from attack. The work covers managing people and staying closely involved in how threats are detected, handled and prevented. It means shaping the day-to-day response to security incidents. The impact on an organisation's security shows up directly in the work done here.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Splunk Enterprise Security / Microsoft Sentinel Strategic/Architect

Leading platform selection/renewal, defining data onboarding strategy, approving major playbook logic, and reporting on ROI and efficacy to leadership. You'll ensure the SIEM is the brain of our SOC.

Palo Alto Cortex XSOAR Strategic/Architect

Defining and overseeing the development of complex SOAR playbooks, integrating with other security tools, and measuring the automation's impact on MTTR and analyst efficiency. You're driving our automation journey.

CrowdStrike Falcon / SentinelOne Singularity / Carbon Black Cloud Strategic/Architect

Setting the EDR/XDR strategy, managing vendor relationships, and ensuring EDR data is integrated into the broader security ecosystem for comprehensive visibility. You'll ensure our endpoints are protected and visible.

Recorded Future / Anomali ThreatStream / Mandiant Advantage Strategic/Architect

Managing the threat intelligence programme, determining subscription levels, and aligning intelligence collection with business risk priorities. You'll ensure we're always aware of the latest threats.

Tenable.io / Qualys VMDR / Rapid7 InsightVM Strategic/Architect

Owning the vulnerability management programme, negotiating remediation SLAs with asset owners, and reporting on risk posture trends to the CISO/CIO. You'll ensure we're proactively addressing weaknesses.

Wiz / Prisma Cloud / Lacework Strategic/Architect

Driving the cloud security strategy, evaluating and selecting tools, and ensuring visibility across multi-cloud environments (AWS, Azure, GCP). You'll secure our cloud footprint.

Jira (with security workflows) / ServiceNow SecOps Strategic/Architect

Defining the entire SecOps ticketing and workflow process, setting SLAs, and using the data to report on team performance and operational trends. You'll ensure our operations run smoothly and are measurable.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Incident Containment Actions Follows pre-defined runbooks, escalates for approval. Independently executes containment actions for routine incidents, escalates complex ones. Leads containment for complex incidents, makes real-time decisions, consults on high-impact actions.
Security Tool Configuration & Tuning Applies pre-approved configuration changes under supervision. Proposes and implements routine configuration changes, tunes existing rules. Designs and implements new detection rules and policies, optimises existing tool configurations.
Team Hiring & Performance Management No hiring authority. Receives performance feedback. No hiring authority. Participates in peer feedback. Interviews candidates, provides input on hiring. Mentors juniors, gives performance feedback.
Budget Allocation (Operational) No budget authority. No budget authority. Recommends expenditure for specific project needs (e.g., training, small tools).

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Mean Time to Respond (MTTR)
The average time it takes your team to contain and eradicate a critical security incident from the moment of detection.
Target · Reduce overall MTTR for critical incidents by 25% year-over-year

If our MTTR for a ransomware incident was 8 hours last year, you'd aim for 6 hours or less this year through process improvements and automation.

Team Retention Rate
The percentage of your SOC team members who remain employed with us over a 12-month period. This is crucial in a high-demand field.
Target · Maintain an analyst turnover rate below 15% annually

If you start the year with 8 analysts and lose only one, that's a 12.5% turnover, hitting your target. It shows you're building a good culture.

Vulnerability Remediation SLA Compliance
The percentage of critical and high-severity vulnerabilities identified that are patched or mitigated within their agreed service level agreements (SLAs).
Target · Achieve >95% SLA compliance for patching critical vulnerabilities

Out of 100 critical vulnerabilities reported, you'd ensure at least 95 are fixed within the 7-day window agreed with the Infrastructure team.

Security Operations Budget Adherence
How closely you manage the operational and capital expenditure for the SOC against the approved budget.
Target · Manage a multi-million pound budget to within 5% of the forecast

If your annual budget is £1.5M, you're expected to spend between £1.425M and £1.575M, avoiding significant overruns or underspending.

Detection Rule Efficacy
The effectiveness of new detection rules deployed by your team in identifying genuine threats versus generating false positives.
Target · Deploy 2-3 new high-fidelity detection rules per quarter with <10% false positive rate

Your team develops a new rule for detecting specific lateral movement techniques. It fires 10 times in a month, and 9 of those are real threats, meaning 90% efficacy.

Team Development & Mentorship
How well you nurture your team's skills, provide growth opportunities, and create a positive working environment.
  • Regular 1:1s focused on career growth
  • at least one analyst promoted or taking on a lead role per year
  • positive feedback in anonymous team surveys
  • analysts actively participating in training and certifications.
Stakeholder Trust & Collaboration
The perceived effectiveness of your team's collaboration with other departments (e.g., IT, Legal, Engineering) during incidents and for proactive security improvements.
  • Other department leads proactively reaching out for security advice
  • smooth post-incident reviews with minimal blame-shifting
  • positive feedback from internal partners on incident communication and resolution
  • your team's input being sought early in new project planning.
Process Optimisation & Automation
Your ability to identify inefficiencies in security operations and implement improvements, including automation via SOAR platforms.
  • Documentation of improved incident response playbooks
  • successful deployment of new SOAR automations that reduce manual effort
  • measurable reduction in 'alert fatigue' reported by analysts
  • regular review and refinement of operational procedures.
Strategic Influence & Vision
Your contribution to the broader security strategy, beyond just day-to-day operations, by providing insights and recommendations to senior leadership.
  • Your input being requested for annual security roadmap planning
  • presenting strategic recommendations to the CISO or Director
  • successful proposals for new security tools or capabilities
  • your team's operational data informing wider security investment decisions.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Protecting the Business

You get a genuine kick out of knowing your team's efforts directly prevent real-world harm. Seeing a threat contained, or a vulnerability patched before it's exploited, gives you a sense of purpose. You're driven by the tangible impact of your work on the organisation's safety.

Successfully leading the response to a phishing campaign that could have led to a major data loss, and then seeing the 'all clear' email go out.

Building and Developing a High-Performing Team

You thrive on seeing your analysts grow, taking on more complex challenges, and becoming experts in their field. Mentoring, coaching, and creating a supportive environment where people can learn from mistakes is what gets you up in the morning. You want to build the best SOC team out there.

Watching a junior analyst you've mentored successfully lead their first major incident response, or seeing a team member achieve a new, challenging certification.

Solving Complex, Real-World Problems

The ever-evolving nature of cyber threats means there's always a new puzzle to solve. You enjoy the challenge of understanding new attack techniques, designing innovative detections, and optimising processes to stay ahead. It's never boring, that's for sure.

Architecting a new SIEM correlation rule that successfully identifies a novel lateral movement technique previously undetected by our tools.

What frustrates people
  • The 2 AM 'War Room' Call: Being the ultimate escalation point means your sleep is never guaranteed, especially during a major incident that requires coordinating a dozen people across IT, Legal, and PR.
  • The 'Vulnerability Whack-a-Mole': You'll report 100 critical vulnerabilities to the infrastructure and DevOps teams, they patch 80, and the next scan finds 120 new ones. It's a never-ending battle for their resources and attention.
  • Justifying Budget After a Quiet Year: Trying to secure a multi-million pound budget for tool renewals and headcount when your success looks like 'nothing bad happened'. You're a cost centre until you're the most important person in the company.
  • Alert Fatigue Burnout: Watching your best analysts burn out from the sheer volume of low-value alerts from noisy tools, and fighting an uphill battle to hire and retain their replacements.
  • The Post-Incident Blame Game: Navigating the political fallout after a breach where other teams try to point fingers, when your focus is solely on the 'lessons learned' review to prevent a recurrence.
  • Tool Sprawl Hell: Inheriting a dozen different security tools that don't integrate, produce conflicting data, and require your team to be experts in everything, rather than masters of a few key platforms.
What this role does not give you
  • Complete control over all security outcomes (you're dependent on other teams for remediation).
  • Predictable work hours, especially during major incidents.
  • A quiet, solitary work environment (it's highly collaborative and often intense).
  • Guaranteed immediate implementation of all your security recommendations.

8Who you work with

This role directly impacts the organisation's ability to detect, respond to, and recover from cyber incidents, protecting critical assets, customer data, and brand reputation. You're accountable for the operational effectiveness of our security defences, which in turn directly influences our compliance standing and overall business continuity. Get it right, and we operate securely; get it wrong, and the business faces significant risk.

Inside the business
  • Director of Security Operations & CISO
  • Infrastructure and DevOps Leads
  • Legal and Compliance Teams
  • Product and Engineering Teams
  • Internal Audit
Outside the business
  • External Security Vendors (e.g., SIEM, EDR providers)
  • Incident Response Retainer Firms
  • Industry peers and information sharing groups (ISACs)
  • External Auditors

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • Extensive experience (at least 5-8 years) as a Senior SOC Analyst or Lead Incident Responder, where you've personally handled complex incidents from start to finish.
  • Proven track record of mentoring junior security professionals and contributing to team development.
  • Demonstrable experience in designing, implementing, and tuning detection rules within a SIEM (e.g., Splunk SPL, Microsoft Sentinel KQL).
  • Experience in managing security projects, including planning, resource allocation, and stakeholder communication.
  • A solid understanding of common scripting languages (e.g., Python, PowerShell) for automation and analysis.
  • Strong analytical and problem-solving skills, with a methodical approach to complex security challenges.

10What to practise next

Where the job is going, and what to do about it starting this week.

Cloud-Native Security Architectures

More of our infrastructure is moving to cloud-native platforms like Kubernetes, serverless functions, and microservices. Understanding the security implications and how to monitor these complex, ephemeral environments will be critical for your team's detection capabilities.

Container security (Docker, Kubernetes) · Serverless function security (AWS Lambda, Azure Fu · Service mesh security (Istio, Linkerd) · Infrastructure as Code (IaC) security scanning · Cloud workload protection platforms (CWPP)

  • This quarter: Attend webinars or online courses on Kubernetes security fundamentals.
  • Next quarter: Work with your DevOps team to understand their current cloud deployment patterns.
  • Month 6: Review your current cloud security monitoring capabilities against cloud-native threats.
  • Month 9: Identify and budget for new tools or training needed to secure cloud-native environments.

Quick win: Ask your cloud security engineers to give your SOC team a '101' on how they build and deploy in the cloud. It bridges the knowledge gap.

Advanced Threat Emulation & Purple Teaming

As adversaries become more sophisticated, simply reacting to alerts isn't enough. Proactive threat emulation and purple teaming—where red and blue teams collaborate—will become standard practice. You'll need to lead these exercises to continuously validate and improve your team's detection and response capabilities.

Adversary simulation frameworks (e.g., Caldera, At · Red team engagement planning and scope · Blue team detection engineering post-simulation · Metrics for measuring purple team effectiveness · Integrating purple team findings into the security

  • This quarter: Research leading threat emulation platforms and methodologies.
  • Next quarter: Plan and execute a small-scale purple team exercise with your team and a red team (internal or external).
  • Month 6: Document lessons learned and integrate findings into your detection roadmap.
  • Month 9: Present the value of purple teaming to senior leadership to secure ongoing budget.

Quick win: Start by running a simple Atomic Red Team test on a non-production system. It's a great way to see what your current tools actually detect.

11Staying current once you are in

What people here do to keep up
  • Regularly attend industry conferences (e.g., Black Hat, DEF CON, RSA Conference) to stay abreast of the latest threats and defensive strategies.
  • Participate in local cyber security meetups or special interest groups (e.g., OWASP, BSides) to network and share knowledge with peers.
  • Contribute to open-source security projects or write blog posts about your experiences and insights in security operations.
  • Engage in continuous learning through online platforms (e.g., SANS OnDemand, Coursera, Cybrary) to deepen technical or leadership skills.
  • Take on internal mentorship opportunities, guiding junior colleagues and solidifying your leadership capabilities.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

AI-Driven Security Orchestration & Response

AI isn't just for alert triage anymore. It's moving into more complex decision-making within SOAR platforms, suggesting containment strategies, and even predicting attack paths. Managers who can effectively integrate and trust AI in their operations will gain a significant advantage.

  • AI-assisted decision support for incident response
  • Predictive analytics for threat modelling
  • Autonomous response capabilities (with human overs
  • Ethical considerations and bias in AI security too
  • Validation and explainability of AI security outpu

Human-Centric Security Leadership

With increasing burnout and a talent shortage in cyber security, retaining and developing your team is paramount. Future managers will need to be experts in psychological safety, empathy, and creating a sustainable work environment, not just technical gurus. It's about leading people, not just processes.

  • Psychological safety in high-stress environments
  • Burnout prevention and resilience building
  • Inclusive leadership for diverse teams
  • Effective feedback loops for continuous growth
  • Mentorship and sponsorship programmes

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Incident Response Frameworks (NIST 800-61, SANS PICERL)
  • MITRE ATT&CK Framework
  • Cyber Kill Chain Methodology
  • Threat Hunting Methodologies
  • SOAR Playbook Development & Automation
  • Purple Teaming & Simulation

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    Senior SOC Analyst / Lead Incident Responder

    5-8 years as an individual contributor

    Skills to master

    • Deep technical incident response, threat hunting, detection engineering, mentoring junior analysts, leading complex incidents end-to-end, and improving operational processes.

    You're ready to move on when

    • Successfully led multiple major incident responses without significant supervision.
    • Consistently identified and implemented improvements to SOC tools or processes.
    • Actively mentored junior team members, helping them grow their skills.
    • Demonstrated strong communication skills with non-technical stakeholders during incidents.
  2. 2

    Security Engineer (with IR focus)

    8-12 years in security engineering, with exposure to operations

    Skills to master

    • Designing and implementing security controls, automation scripting, cloud security architecture, and a strong understanding of how systems are built and exploited. You'd need to gain more direct incident response experience.

    You're ready to move on when

    • Designed and implemented significant security infrastructure projects.
    • Automated security tasks using scripting languages.
    • Collaborated closely with SOC teams on detection and response capabilities.
    • Understood the operational challenges of a 24/7 security function.
  3. 3

    Consultant (Security Operations)

    10-15 years in security consulting, specialising in SOC/IR

    Skills to master

    • Broad exposure to different SOC models and technologies, experience in building and optimising security operations for various clients, strong client management and communication skills. You'd need to adapt to an in-house, long-term focus.

    You're ready to move on when

    • Successfully delivered SOC maturity assessments or build-out projects for clients.
    • Developed and presented strategic security operations roadmaps.
    • Managed project teams and client expectations effectively.
    • Demonstrated ability to translate consulting insights into practical, implementable solutions.

15Where this role leads

The long view: This role can lead to Chief Information Security Officer or Head of Cyber Security. It can also lead to VP of Cyber Threat Management. The path depends on whether it goes towards leadership or deeper technical specialism.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Security Operations Manager is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Incident Response, Investigations and Forensics, worked against Security Operations Manager.

Incident Response, Investigations and Forensics Level 5

Applied to your work in Security Operations Manager

This unit aims to equip learners with an understanding of incident response as a business function, including the operation of Computer Emergency Response Teams (CERTs) and aligned task forces for business continuity, disaster recovery, and crisis management. Learners will also understand how major computer incidents are formally investigated, including evidence gathering and analysis, and the relevant legal and ethical considerations.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
Security Operations Manager
  • Incident Response Frameworks (NIST 800-61, SANS PICERL)
  • MITRE ATT&CK Framework
  • Cyber Kill Chain Methodology
  • Threat Hunting Methodologies
  • SOAR Playbook Development & Automation
  • Purple Teaming & Simulation
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Security Operations Manager is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Director of Security Operations

    3-5 years in Security Operations Manager role

    L6

    • Developing and owning the overall security operations strategy and roadmap.
    • Managing larger budgets (typically £2M-£10M+).
    • Driving cross-functional security initiatives across the entire organisation.
    • Representing the organisation in industry forums and with regulators.
    • Leading major security transformation programmes.
Working with AI on the job

Working with AI

Where AI is starting to help

As a Security Operations Manager, you're constantly fighting alert fatigue and trying to do more with less. The good news? AI isn't just a buzzword; it's a game-changer for your team's productivity and your overall security posture. Imagine cutting down on the noise, accelerating investigations, and giving your analysts more time to focus on what truly matters.

We're not talking about replacing your team; we're talking about giving them superpowers. By embedding AI into our security operations, we're empowering your analysts to work smarter, faster, and with greater precision. This means you, as their manager, can focus on strategy, team development, and truly impactful projects, rather than getting bogged down in the daily grind.

Automated Alert Triage

Use AI engines (often built into SIEM/XDR platforms) to automatically investigate, enrich, and even close low-confidence alerts. This handles the initial data gathering – WhoIs lookups, file reputation checks – that your analysts currently do manually, freeing them up for real threats.

Accelerated Threat Analysis

AI models can analyse billions of data points to identify anomalous user or entity behaviour that deviates from a learned baseline. This helps surface the 'unknown unknowns' that traditional, rule-based detections would miss, drastically reducing manual threat hunting time.

AI-Powered Threat Research

Use Generative AI to quickly summarise new vulnerability disclosures (CVEs), translate obfuscated code snippets from malware samples, or generate natural language queries for threat hunting based on a high-level hypothesis. It speeds up research and lowers the barrier to entry for complex investigation tasks.

Instant Incident Summaries

At the end of an incident, feed the timeline, technical indicators, and chat logs into an AI model to generate a first draft of the executive summary and the detailed post-incident report. This eliminates writer's block and ensures consistent, high-quality reporting, saving hours per incident.

Common questions

Common questions

How do you become a Security Operations Manager?

Common routes in include Senior SOC Analyst / Lead Incident Responder (5-8 years as an individual contributor), Security Engineer (with IR focus) (8-12 years in security engineering, with exposure to operations) and Consultant (Security Operations) (10-15 years in security consulting, specialising in SOC/IR). Times vary with prior experience.

Where can a Security Operations Manager progress to?

This role can lead on to Director of Security Operations (3-5 years in Security Operations Manager role), depending on the skills you build.

What new skills matter most for a Security Operations Manager?

Increasingly, AI-Driven Security Orchestration & Response and Human-Centric Security Leadership. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 5

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built as a Security Operations Manager transfer across almost any industry. Any organisation with a digital presence needs security operations, so this experience applies in finance, healthcare, government or technology.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free Automation Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.