SOC Manager

About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Notion, Cursor, Lovable, Replit, and Mercor, and Iru partners with industry leaders such as ServiceNow and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

The Opportunity:

Iru is building a next-generation Security Operations function to support a modern SaaS platform spanning Identity, Endpoint Management, EDR, and cloud-native infrastructure.

We are seeking a SOC Manager to lead and mature a hybrid SOC model, combining internal capabilities with our MDR partner (Managed SOC Provider). This role is accountable for defining how security operations run at Iru—owning governance, detection strategy, incident response, and operational excellence.

You will act as the central owner of security operations, ensuring we have strong visibility, fast response, and continuous improvement across our environment. 

\n

Day To Day: SOC Governance & Operating Model

• Define and operationalize the SOC mission, scope, and service boundaries

• Establish a clear roles, responsibilities, and escalation hierarchy

• Build and maintain a RACI model across internal teams and Managed SOC Provider

• Own the effectiveness and maturity of Iru’s hybrid SOC model

Operational Ownership & Execution

• Clearly define and enforce ownership across:

  • Detection engineering

  • Threat intelligence

  • Tier 1 alert triage

  • 24/7 monitoring

  • Incident response leadership

  • Threat hunting

  • Escalation investigations

• Establish and manage the “first call” model for security incidents at Iru

• Serve as incident commander for high-severity events or delegate appropriately

MDR (Managed SOC Provider) Management

• Own the operational relationship with Managed SOC Provider

• Ensure alignment on:

  • Alert triage quality and consistency

  • Escalation thresholds and timelines

  • Detection coverage across environments

  • Incident response coordination

• Hold Managed SOC Provider accountable to defined SLAs and performance expectations

• Continuously improve MDR effectiveness through feedback loops and tuning

Detection Engineering

• Build and maintain a central detection catalog

• Align detections to MITRE ATT&CK where applicable

• Partner with internal teams and Managed SOC Provider to:

  • Develop new detections

  • Tune and optimize existing rules

  • Reduce false positives and noise

• Ensure detection coverage across:

  • Identity (Iru Identity, Entra)

  • Endpoint (EM / EDR)

  • Cloud (AWS)

  • SaaS and integrations

Data & Telemetry Strategy

• Maintain a complete inventory of all telemetry sources across:

  • Endpoint, Identity, Cloud, Network, SaaS

• For each data source:

  • Define system owner

  • Confirm ingestion into Panther SIEM

  • Validate data quality and coverage

• Drive onboarding of new log sources to close visibility gaps

Incident Response Framework

• Design and maintain Iru’s incident response framework, including:

  • Incident classification and severity model

  • Evidence collection standards

  • Containment and remediation procedures

  • Recovery processes

  • Post-incident review and lessons learned

• Ensure consistent execution across internal teams and Managed SOC Provider

Runbooks & Playbooks

• Develop and maintain:

  • Alert triage procedures

  • Investigation runbooks

  • Incident response playbooks

• Ensure all runbooks are actionable, tested, and continuously improved

Threat Intelligence & Hunting

• Integrate threat intelligence into detection and response workflows

• Define ownership model for threat intelligence (internal vs MDR)

• Establish proactive threat hunting capabilities

• Evaluate and integrate external threat hunting services as needed

SOC Metrics & Reporting

• Define and track key SOC KPIs:

  • Mean Time to Detect (MTTD)

  • Mean Time to Respond (MTTR)

  • Alert volume and trends

  • False positive rates

  • Detection coverage and gaps

• Provide regular reporting to Security Leadership and executive stakeholders

• Use metrics to drive SOC maturity and continuous improvement

Nice to haves, but NOT required:

• Prior experience helping mature or build a security operations program from the ground up.

• Background in threat hunting or detection engineering.

• Experience integrating Wiz or similar cloud posture management tools into a SIEM workflow.

• Knowledge of security automation frameworks, including alert enrichment and workflow orchestration.

• Hands-on experience supporting hybrid (Mac + Windows) endpoint environments.

\n

Benefits & Perks

Competitive salary

Hybrid work environment (3 days in office per week) 

100% individual and dependent medical + dental + vision coverage

401(K) with a 4% company match

20 days PTO

Iru Wellness Week the first week in July

Equity for full-time employees

In-office lunch stipend provided

Up to 16 weeks of paid leave for new parents

Paid Family and Medical Leave

Modern Health mental health benefits for individuals and dependents

Fertility benefits

Working Advantage employee discounts

Onsite fitness center

Free parking

Exciting opportunities for career growth

We are excited to be serving a significant need for a fast-growing market, and are proud of the high-performing team we have brought together so far. If you’re someone who wants to engage in new, exciting projects that will challenge your skills in the best way possible, we would love to connect with you.

At Iru, we believe in fostering an inclusive environment in which employees feel encouraged to share their unique perspectives, leverage their strengths, and act authentically. We know that diverse teams are strong teams, and welcome those from all backgrounds and varying experiences.

Iru is proud to be an equal opportunity employer committed to diversity and inclusion in the workplace. Qualified applicants will be considered for employment without regard to race, color, religion, national origin, age, sex, sexual orientation, gender identity, physical or mental disability, protected veteran or military status or any other status protected by applicable law. #LI-Hybrid