Security Operations Center Group Manager (L3)

Cyber Defense Operations Section operates a 24/7 Security Operations Center (SOC) protecting Rakuten Group's critical infrastructure. We are currently in a critical transformation phase to address the era of autonomous, AI-driven cyber threats. Our goal is to evolve from a reactive monitoring unit into a proactive, intelligence-led, and autonomous defense organization. We are seeking a visionary and hands-on SOC Lead to architect our future-ready security operations, leveraging AI and automation to neutralize machine-speed attacks while mentoring high-performing security talent.

Strategic Transformation: Lead the evolution of the SOC from a reactive monitoring unit to an autonomous, AI-augmented defense organization.

AI & Automation Engineering: Architect and implement AI-driven detection and response workflows. Drive the integration of SOAR (Security Orchestration, Automation, and Response) to counter autonomous AI attacks.

Operational Leadership: Manage the 24/7 SOC team, ensuring high-availability monitoring, rapid incident response, and continuous service improvement.

Technical Oversight: Provide L3-level escalation support for complex incidents. Oversee security monitoring of Telco-specific network architectures, containerized environments, and Kubernetes (K8s) clusters.

Governance & Documentation: Establish rigorous SOC governance, including the creation and maintenance of playbooks and SOPs that meet international audit and compliance standards.

DFIR & Root Cause Analysis: Assist in high-stakes Digital Forensics and Incident Response (DFIR) efforts, conducting deep-dive analysis to harden the environment against future threats.

Stakeholder Collaboration: Partner with cross-functional security teams and Business Units to ensure security is integrated throughout the infrastructure lifecycle.

Innovation & Research: Stay at the bleeding edge of offensive and defensive AI research to proactively adapt security posture against evolving adversary tactics.

Reporting: Reports to the Head of Cyber Defense Operations Section.

Collaboration: Manages the 24/7 SOC team and collaborates cross-departmentally with other security functions and Business Units.

Tech Stack: Containerization (Docker/K8s), Telco environment (5G Core, Signaling Protocols), SOAR platforms, Python/Go/Bash, Cloud Security (AWS/Azure/GCP), and LLM-based security tools.