SOC Manager

About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Notion, Cursor, Lovable, Replit, and Mercor, and Iru partners with industry leaders such as Service Now and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

Iru is building a next-generation Security Operations function to support a modern SaaS platform spanning Identity, Endpoint Management, EDR, and cloud-native infrastructure.

We are seeking a SOC Manager to lead and mature a hybrid SOC model, combining internal capabilities with our MDR partner (Managed SOC Provider). This role is accountable for defining how security operations run at Iru—owning governance, detection strategy, incident response, and operational excellence.

You will act as the central owner of security operations, ensuring we have strong visibility, fast response, and continuous improvement across our environment.

• Define and operationalize the SOC mission, scope, and service boundaries
• Establish a clear roles, responsibilities, and escalation hierarchy
• Build and maintain a RACI model across internal teams and Managed SOC Provider
• Own the effectiveness and maturity of Iru’s hybrid SOC model

• Clearly define and enforce ownership across:
  • Detection engineering
  • Threat intelligence
  • Tier 1 alert triage
  • 24/7 monitoring
  • Incident response leadership
  • Threat hunting
  • Escalation investigations
• Establish and manage the “first call” model for security incidents at Iru
• Serve as incident commander for high‑severity events or delegate appropriately

• Own the operational relationship with Managed SOC Provider
• Ensure alignment on:
  • Alert triage quality and consistency
  • Escalation thresholds and timelines
  • Detection coverage across environments
  • Incident response coordination
• Hold Managed SOC Provider accountable to defined SLAs and performance expectations
• Continuously improve MDR effectiveness through feedback loops and tuning

• Build and maintain a central detection catalog
• Align detections to MITRE ATT&CK where applicable
• Partner with internal teams and Managed SOC Provider to:
  • Develop new detections
  • Tune and optimize existing rules
  • Reduce false positives and noise
• Ensure detection coverage across:
  • Identity (Iru Identity, Entra)
  • Endpoint (EM / EDR)
  • Cloud (AWS)
  • SaaS and integrations

• Maintain a complete inventory of all telemetry sources across:
  • Endpoint, Identity, Cloud, Network, SaaS
• For each data source:
  • Define system owner
  • Confirm ingestion into Panther SIEM
  • Validate data quality and coverage
• Drive onboarding of new log sources to close visibility gaps

• Design and maintain Iru’s incident response framework, including:
  • Incident classification and severity model
  • Evidence collection standards
  • Containment and remediation procedures
  • Recovery processes
  • Post‑incident review and lessons learned
• Ensure consistent execution across internal teams and Managed SOC Provider

• Develop and maintain:
  • Alert triage procedures
  • Investigation runbooks
  • Incident response playbooks
• Ensure all runbooks are actionable, tested, and continuously improved

• Integrate threat intelligence into detection and response workflows
• Define ownership model for threat intelligence (internal vs MDR)
• Establish proactive threat hunting capabilities
• Evaluate and integrate external threat hunting services as needed

• Define and track key SOC KPIs:
  • Mean Time to Detect (MTTD)
  • Mean Time to Respond (MTTR)
  • Alert volume and trends
  • False positive rates
  • Detection coverage and gaps
• Provi…